[STATEMENT]
lemma \<R>_typed_step:
  "\<lbrakk> \<turnstile> \<Gamma>,\<S>,P { c\<^sub>1 } \<Gamma>',\<S>',P' ;
  tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1;
        pred P mem\<^sub>2; tyenv_sec mds \<Gamma> mem\<^sub>1;
     \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<rbrakk> \<Longrightarrow>
   (\<exists> c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and>
                 \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1} \<Gamma>',\<S>',P'; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
proof (induct arbitrary: mds c\<^sub>1' rule: has_type.induct)
[PROOF STATE]
proof (state)
goal (11 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma> \<S> P c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>',\<S>',P' {c\<^sub>2} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
A total of 11 subgoals...
[PROOF STEP]
case (seq_type \<Gamma> \<S> P c\<^sub>1 \<Gamma>'' \<S>'' P'' c\<^sub>2 \<Gamma>' \<S>' P' mds)
[PROOF STATE]
proof (state)
this:
\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<turnstile> \<Gamma>'',\<S>'',P'' {c\<^sub>2} \<Gamma>',\<S>',P'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>'' \<S>'' P''; mem\<^sub>1 =\<^bsub>\<Gamma>''\<^esub> mem\<^sub>2; pred P'' mem\<^sub>1; pred P'' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>''. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>'' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (11 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma> \<S> P c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>',\<S>',P' {c\<^sub>2} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
A total of 11 subgoals...
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
proof (cases "c\<^sub>1 = Stop")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. c\<^sub>1 = Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
assume "c\<^sub>1 = Stop"
[PROOF STATE]
proof (state)
this:
c\<^sub>1 = Stop

goal (2 subgoals):
 1. c\<^sub>1 = Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
hence [simp]: "c\<^sub>1' = c\<^sub>2" "mds' = mds" "mem\<^sub>1' = mem\<^sub>1"
[PROOF STATE]
proof (prove)
using this:
c\<^sub>1 = Stop

goal (1 subgoal):
 1. c\<^sub>1' = c\<^sub>2 &&& mds' = mds &&& mem\<^sub>1' = mem\<^sub>1
[PROOF STEP]
using seq_type
[PROOF STATE]
proof (prove)
using this:
c\<^sub>1 = Stop
\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<turnstile> \<Gamma>'',\<S>'',P'' {c\<^sub>2} \<Gamma>',\<S>',P'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>'' \<S>'' P''; mem\<^sub>1 =\<^bsub>\<Gamma>''\<^esub> mem\<^sub>2; pred P'' mem\<^sub>1; pred P'' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>''. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>'' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. c\<^sub>1' = c\<^sub>2 &&& mds' = mds &&& mem\<^sub>1' = mem\<^sub>1
[PROOF STEP]
by (auto simp: seq_stop_elim)
[PROOF STATE]
proof (state)
this:
c\<^sub>1' = c\<^sub>2
mds' = mds
mem\<^sub>1' = mem\<^sub>1

goal (2 subgoals):
 1. c\<^sub>1 = Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from seq_type \<open>c\<^sub>1 = Stop\<close>
[PROOF STATE]
proof (chain)
picking this:
\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<turnstile> \<Gamma>'',\<S>'',P'' {c\<^sub>2} \<Gamma>',\<S>',P'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>'' \<S>'' P''; mem\<^sub>1 =\<^bsub>\<Gamma>''\<^esub> mem\<^sub>2; pred P'' mem\<^sub>1; pred P'' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>''. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>'' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1 = Stop
[PROOF STEP]
have "context_equiv \<Gamma> P \<Gamma>''" and "\<S> = \<S>''" and "P \<turnstile> P''" and
                                   "(\<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed  mds \<Gamma>'' \<S> P'')"
[PROOF STATE]
proof (prove)
using this:
\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<turnstile> \<Gamma>'',\<S>'',P'' {c\<^sub>2} \<Gamma>',\<S>',P'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>'' \<S>'' P''; mem\<^sub>1 =\<^bsub>\<Gamma>''\<^esub> mem\<^sub>2; pred P'' mem\<^sub>1; pred P'' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>''. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>'' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1 = Stop

goal (1 subgoal):
 1. (\<Gamma> =:\<^sub>P \<Gamma>'' &&& \<S> = \<S>'') &&& P \<turnstile> P'' &&& \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''
[PROOF STEP]
by (metis stop_cxt)+
[PROOF STATE]
proof (state)
this:
\<Gamma> =:\<^sub>P \<Gamma>''
\<S> = \<S>''
P \<turnstile> P''
\<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''

goal (2 subgoals):
 1. c\<^sub>1 = Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
hence "\<turnstile> \<Gamma>,\<S>,P { c\<^sub>2 } \<Gamma>',\<S>',P'"
[PROOF STATE]
proof (prove)
using this:
\<Gamma> =:\<^sub>P \<Gamma>''
\<S> = \<S>''
P \<turnstile> P''
\<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''

goal (1 subgoal):
 1. \<turnstile> \<Gamma>,\<S>,P {c\<^sub>2} \<Gamma>',\<S>',P'
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<turnstile> \<Gamma>,\<S>,P {c\<^sub>2} \<Gamma>',\<S>',P'
[PROOF STEP]
apply(rule sub)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<turnstile> ?\<Gamma>\<^sub>14,\<S>,?P\<^sub>14 {c\<^sub>2} ?\<Gamma>\<^sub>1'4,\<S>',?P\<^sub>1'4
 2. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<Gamma> =:\<^sub>P ?\<Gamma>\<^sub>14
 3. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds ?\<Gamma>\<^sub>14 \<S> ?P\<^sub>14
 4. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds ?\<Gamma>\<^sub>1'4 \<S>' ?P\<^sub>1'4 \<longrightarrow> tyenv_wellformed mds \<Gamma>' \<S>' P'
 5. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> ?\<Gamma>\<^sub>1'4 =:\<^sub>?P\<^sub>1'4 \<Gamma>'
 6. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> P \<turnstile> ?P\<^sub>14
 7. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> ?P\<^sub>1'4 \<turnstile> P'
[PROOF STEP]
using seq_type(3)
[PROOF STATE]
proof (prove)
using this:
\<turnstile> \<Gamma>'',\<S>'',P'' {c\<^sub>2} \<Gamma>',\<S>',P'

goal (7 subgoals):
 1. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<turnstile> ?\<Gamma>\<^sub>14,\<S>,?P\<^sub>14 {c\<^sub>2} ?\<Gamma>\<^sub>1'4,\<S>',?P\<^sub>1'4
 2. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<Gamma> =:\<^sub>P ?\<Gamma>\<^sub>14
 3. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds ?\<Gamma>\<^sub>14 \<S> ?P\<^sub>14
 4. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds ?\<Gamma>\<^sub>1'4 \<S>' ?P\<^sub>1'4 \<longrightarrow> tyenv_wellformed mds \<Gamma>' \<S>' P'
 5. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> ?\<Gamma>\<^sub>1'4 =:\<^sub>?P\<^sub>1'4 \<Gamma>'
 6. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> P \<turnstile> ?P\<^sub>14
 7. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> ?P\<^sub>1'4 \<turnstile> P'
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<Gamma> =:\<^sub>P \<Gamma>''
 2. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''
 3. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>' \<S>' P'
 4. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> \<Gamma>' =:\<^sub>P' \<Gamma>'
 5. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> P \<turnstile> P''
 6. \<lbrakk>\<Gamma> =:\<^sub>P \<Gamma>''; \<S> = \<S>''; P \<turnstile> P''; \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma>'' \<S> P''\<rbrakk> \<Longrightarrow> P' \<turnstile> P'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<turnstile> \<Gamma>,\<S>,P {c\<^sub>2} \<Gamma>',\<S>',P'

goal (2 subgoals):
 1. c\<^sub>1 = Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "\<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
[PROOF STEP]
apply (rule \<R>\<^sub>1.intro [of \<Gamma>])
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<turnstile> \<Gamma>,?\<S>,?P {c\<^sub>2} \<Gamma>',\<S>',P'
 2. tyenv_wellformed mds \<Gamma> ?\<S> ?P
 3. mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
 4. pred ?P mem\<^sub>1
 5. pred ?P mem\<^sub>2
 6. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(rule \<open>\<turnstile> \<Gamma>,\<S>,P { c\<^sub>2 } \<Gamma>',\<S>',P'\<close>)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P
 2. mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
 3. pred P mem\<^sub>1
 4. pred P mem\<^sub>2
 5. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using seq_type
[PROOF STATE]
proof (prove)
using this:
\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<turnstile> \<Gamma>'',\<S>'',P'' {c\<^sub>2} \<Gamma>',\<S>',P'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>'' \<S>'' P''; mem\<^sub>1 =\<^bsub>\<Gamma>''\<^esub> mem\<^sub>2; pred P'' mem\<^sub>1; pred P'' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>''. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>'' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (5 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P
 2. mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
 3. pred P mem\<^sub>1
 4. pred P mem\<^sub>2
 5. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>

goal (2 subgoals):
 1. c\<^sub>1 = Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
using \<R>.intro\<^sub>1
[PROOF STATE]
proof (prove)
using this:
\<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
(case ?lc of (x, xa) \<Rightarrow> (case x of (x, xa) \<Rightarrow> \<lambda>xb ((xc, xd), xe). \<langle>x, xa, xb\<rangle> \<R>\<^sup>1\<^bsub>?\<Gamma>,?\<S>,?P\<^esub> \<langle>xc, xd, xe\<rangle>) xa) ?lc' \<Longrightarrow> ?lc \<R>\<^sup>u\<^bsub>?\<Gamma>,?\<S>,?P\<^esub> ?lc'

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<And>\<Gamma> a b P aa ba bb ab bc bd. \<langle>aa, ba, bb\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,(a, b),P\<^esub> \<langle>ab, bc, bd\<rangle> \<Longrightarrow> \<langle>aa, ba, bb\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,(a, b),P\<^esub> \<langle>ab, bc, bd\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
apply (rule_tac x = c\<^sub>2 in exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<And>\<Gamma> a b P aa ba bb ab bc bd. \<langle>aa, ba, bb\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,(a, b),P\<^esub> \<langle>ab, bc, bd\<rangle> \<Longrightarrow> \<langle>aa, ba, bb\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,(a, b),P\<^esub> \<langle>ab, bc, bd\<rangle>\<rbrakk> \<Longrightarrow> \<exists>mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2, mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
apply (rule_tac x = mem\<^sub>2 in exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<And>\<Gamma> a b P aa ba bb ab bc bd. \<langle>aa, ba, bb\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,(a, b),P\<^esub> \<langle>ab, bc, bd\<rangle> \<Longrightarrow> \<langle>aa, ba, bb\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,(a, b),P\<^esub> \<langle>ab, bc, bd\<rangle>\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2, mds', mem\<^sub>2\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds', mem\<^sub>2\<rangle>
[PROOF STEP]
by (auto simp: \<open>c\<^sub>1 = Stop\<close> seq_stop_eval\<^sub>w  \<R>.intro\<^sub>1)
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
assume "c\<^sub>1 \<noteq> Stop"
[PROOF STATE]
proof (state)
this:
c\<^sub>1 \<noteq> Stop

goal (1 subgoal):
 1. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
with \<open>\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<close>
[PROOF STATE]
proof (chain)
picking this:
\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1 \<noteq> Stop
[PROOF STEP]
obtain c\<^sub>1'' where c\<^sub>1''_props:
      "\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<and> c\<^sub>1' = c\<^sub>1'' ;; c\<^sub>2"
[PROOF STATE]
proof (prove)
using this:
\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1 \<noteq> Stop

goal (1 subgoal):
 1. (\<And>c\<^sub>1''''. \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1'''', mds', mem\<^sub>1'\<rangle> \<and> c\<^sub>1' = c\<^sub>1'''' ;; c\<^sub>2 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis seq_elim)
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<and> c\<^sub>1' = c\<^sub>1'' ;; c\<^sub>2

goal (1 subgoal):
 1. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
with seq_type(2)
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<and> c\<^sub>1' = c\<^sub>1'' ;; c\<^sub>2
[PROOF STEP]
obtain c\<^sub>2'' mem\<^sub>2' where c\<^sub>2''_props:
      "\<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<and> c\<^sub>1' = c\<^sub>1'' ;; c\<^sub>2

goal (1 subgoal):
 1. (\<And>c\<^sub>2'' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using seq_type.prems(1) seq_type.prems(2) seq_type.prems(3) seq_type.prems(4) seq_type.prems(5)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<and> c\<^sub>1' = c\<^sub>1'' ;; c\<^sub>2
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x

goal (1 subgoal):
 1. (\<And>c\<^sub>2'' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
hence "\<langle>c\<^sub>1'' ;; c\<^sub>2, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
\<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. \<langle>c\<^sub>1'' ;; c\<^sub>2, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
apply (rule conjE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>; \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1'' ;; c\<^sub>2, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
apply (erule \<R>_elim, auto)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>; \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1'' ;; c\<^sub>2, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>
 2. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>; \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1'' ;; c\<^sub>2, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
apply (metis \<R>.intro\<^sub>3 \<R>\<^sub>3_aux.intro\<^sub>1 seq_type(3))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>; \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1'' ;; c\<^sub>2, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by (metis \<R>.intro\<^sub>3 \<R>\<^sub>3_aux.intro\<^sub>3 seq_type(3))
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1'' ;; c\<^sub>2, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1'' ;; c\<^sub>2, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from c\<^sub>2''_props
[PROOF STATE]
proof (chain)
picking this:
\<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
\<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1'', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2'', mds', mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by (metis eval\<^sub>w.seq)
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. c\<^sub>1 \<noteq> Stop \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<langle>c\<^sub>1'' ;; c\<^sub>2, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<langle>c\<^sub>1'' ;; c\<^sub>2, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2'' ;; c\<^sub>2, mds', mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by (metis c\<^sub>1''_props)
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1 ;; c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (10 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (10 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
case (anno_type \<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds)
[PROOF STATE]
proof (state)
this:
\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd
\<S>' = add_anno_stable \<S> upd
P' = P |` {v. local.stable \<S>' v}
\<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
c \<noteq> Stop
to_total \<Gamma> ?x5 \<le>:\<^sub>P' to_total \<Gamma>' ?x5
anno_type_stable \<Gamma> \<S> upd
anno_type_sec \<Gamma> \<S> P upd
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (10 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2
[PROOF STEP]
proof(clarsimp simp: tyenv_eq_def)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x
[PROOF STEP]
assume a: "type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low"
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low

goal (1 subgoal):
 1. \<And>x. type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x
[PROOF STEP]
hence "type_max (to_total \<Gamma> x) mem\<^sub>1 = Low"
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low

goal (1 subgoal):
 1. type_max (to_total \<Gamma> x) mem\<^sub>1 = Low
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low \<Longrightarrow> type_max (to_total \<Gamma> x) mem\<^sub>1 = Low
[PROOF STEP]
from \<open>pred P mem\<^sub>1\<close>
[PROOF STATE]
proof (chain)
picking this:
pred P mem\<^sub>1
[PROOF STEP]
have "pred P' mem\<^sub>1"
[PROOF STATE]
proof (prove)
using this:
pred P mem\<^sub>1

goal (1 subgoal):
 1. pred P' mem\<^sub>1
[PROOF STEP]
using anno_type.hyps(3)
[PROOF STATE]
proof (prove)
using this:
pred P mem\<^sub>1
P' = P |` {v. local.stable \<S>' v}

goal (1 subgoal):
 1. pred P' mem\<^sub>1
[PROOF STEP]
by(auto simp: restrict_preds_to_vars_def pred_def)
[PROOF STATE]
proof (state)
this:
pred P' mem\<^sub>1

goal (1 subgoal):
 1. type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low \<Longrightarrow> type_max (to_total \<Gamma> x) mem\<^sub>1 = Low
[PROOF STEP]
with subtype_sound[OF anno_type.hyps(7)] a
[PROOF STATE]
proof (chain)
picking this:
\<forall>mem. pred P' mem \<longrightarrow> type_max (to_total \<Gamma> ?x6) mem \<le> type_max (to_total \<Gamma>' ?x6) mem
type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low
pred P' mem\<^sub>1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<forall>mem. pred P' mem \<longrightarrow> type_max (to_total \<Gamma> ?x6) mem \<le> type_max (to_total \<Gamma>' ?x6) mem
type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low
pred P' mem\<^sub>1

goal (1 subgoal):
 1. type_max (to_total \<Gamma> x) mem\<^sub>1 = Low
[PROOF STEP]
using less_eq_Sec_def
[PROOF STATE]
proof (prove)
using this:
\<forall>mem. pred P' mem \<longrightarrow> type_max (to_total \<Gamma> ?x6) mem \<le> type_max (to_total \<Gamma>' ?x6) mem
type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low
pred P' mem\<^sub>1
(?d1.0 \<le> ?d2.0) = (?d1.0 = ?d2.0 \<or> ?d1.0 = Low)

goal (1 subgoal):
 1. type_max (to_total \<Gamma> x) mem\<^sub>1 = Low
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> x) mem\<^sub>1 = Low

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> x) mem\<^sub>1 = Low

goal (1 subgoal):
 1. \<And>x. type_max (to_total \<Gamma>' x) mem\<^sub>1 = Low \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x
[PROOF STEP]
thus " mem\<^sub>1 x = mem\<^sub>2 x"
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> x) mem\<^sub>1 = Low

goal (1 subgoal):
 1. mem\<^sub>1 x = mem\<^sub>2 x
[PROOF STEP]
using anno_type.prems(2)
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> x) mem\<^sub>1 = Low
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2

goal (1 subgoal):
 1. mem\<^sub>1 x = mem\<^sub>2 x
[PROOF STEP]
unfolding tyenv_eq_def
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> x) mem\<^sub>1 = Low
\<forall>x. type_max (to_total \<Gamma> x) mem\<^sub>1 = Low \<longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x

goal (1 subgoal):
 1. mem\<^sub>1 x = mem\<^sub>2 x
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 x = mem\<^sub>2 x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2

goal (10 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed (update_modes upd mds) \<Gamma>' \<S>' P'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed (update_modes upd mds) \<Gamma>' \<S>' P'
[PROOF STEP]
using anno_type
[PROOF STATE]
proof (prove)
using this:
\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd
\<S>' = add_anno_stable \<S> upd
P' = P |` {v. local.stable \<S>' v}
\<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
c \<noteq> Stop
to_total \<Gamma> ?x5 \<le>:\<^sub>P' to_total \<Gamma>' ?x5
anno_type_stable \<Gamma> \<S> upd
anno_type_sec \<Gamma> \<S> P upd
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed (update_modes upd mds) \<Gamma>' \<S>' P'
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable (add_anno_stable \<S> upd) v}; \<turnstile> \<Gamma> \<oplus>\<^sub>\<S> upd,add_anno_stable \<S> upd,P |` {v. local.stable (add_anno_stable \<S> upd) v} {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<oplus>\<^sub>\<S> upd (add_anno_stable \<S> upd) P |` {v. local.stable (add_anno_stable \<S> upd) v}; mem\<^sub>1 =\<^bsub>\<Gamma> \<oplus>\<^sub>\<S> upd\<^esub> mem\<^sub>2; pred P |` {v. local.stable (add_anno_stable \<S> upd) v} mem\<^sub>1; pred P |` {v. local.stable (add_anno_stable \<S> upd) v} mem\<^sub>2; \<forall>x\<in>dom \<Gamma> \<oplus>\<^sub>\<S> upd. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> \<oplus>\<^sub>\<S> upd x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P |` {v. local.stable (add_anno_stable \<S> upd) v} to_total \<Gamma> \<oplus>\<^sub>\<S> upd x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> tyenv_wellformed (update_modes upd mds) \<Gamma> \<oplus>\<^sub>\<S> upd (add_anno_stable \<S> upd) P |` Collect (local.stable (add_anno_stable \<S> upd))
[PROOF STEP]
by (metis tyenv_wellformed_mode_update)
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed (update_modes upd mds) \<Gamma>' \<S>' P'

goal (10 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed (update_modes upd mds) \<Gamma>' \<S>' P'

goal (10 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have pred: "pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1
[PROOF STEP]
using anno_type
[PROOF STATE]
proof (prove)
using this:
\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd
\<S>' = add_anno_stable \<S> upd
P' = P |` {v. local.stable \<S>' v}
\<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
c \<noteq> Stop
to_total \<Gamma> ?x5 \<le>:\<^sub>P' to_total \<Gamma>' ?x5
anno_type_stable \<Gamma> \<S> upd
anno_type_sec \<Gamma> \<S> P upd
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1
[PROOF STEP]
by (auto simp: pred_def restrict_preds_to_vars_def)
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1

goal (10 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1

goal (10 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> tyenv_sec mds \<Gamma> mem\<^sub>1 \<longrightarrow>
        tyenv_sec (update_modes upd mds) \<Gamma>' mem\<^sub>1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>'. x \<notin> update_modes upd mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
[PROOF STEP]
apply(rule impI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>'. x \<notin> update_modes upd mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(rule tyenv_sec_mode_update)
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x. to_total ?\<Gamma>2 x \<le>:\<^sub>?P''2 to_total \<Gamma>' x
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> pred ?P''2 mem\<^sub>1
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>2 = (mds AsmNoWrite, mds AsmNoReadOrWrite)
 4. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> anno_type_sec ?\<Gamma>2 ?\<S>2 ?P2 upd
 5. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>''2 = add_anno_stable ?\<S>2 upd
 6. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> type_stable ?\<S>2 ?P2
 7. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?P''2 = ?P2 |` {v. local.stable ?\<S>''2 v}
 8. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = ?\<Gamma>2 \<oplus>\<^sub>?\<S>2 upd
 9. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom ?\<Gamma>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (?\<Gamma>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using anno_type
[PROOF STATE]
proof (prove)
using this:
\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd
\<S>' = add_anno_stable \<S> upd
P' = P |` {v. local.stable \<S>' v}
\<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
c \<noteq> Stop
to_total \<Gamma> ?x5 \<le>:\<^sub>P' to_total \<Gamma>' ?x5
anno_type_stable \<Gamma> \<S> upd
anno_type_sec \<Gamma> \<S> P upd
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (9 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x. to_total ?\<Gamma>2 x \<le>:\<^sub>?P''2 to_total \<Gamma>' x
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> pred ?P''2 mem\<^sub>1
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>2 = (mds AsmNoWrite, mds AsmNoReadOrWrite)
 4. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> anno_type_sec ?\<Gamma>2 ?\<S>2 ?P2 upd
 5. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>''2 = add_anno_stable ?\<S>2 upd
 6. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> type_stable ?\<S>2 ?P2
 7. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?P''2 = ?P2 |` {v. local.stable ?\<S>''2 v}
 8. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = ?\<Gamma>2 \<oplus>\<^sub>?\<S>2 upd
 9. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom ?\<Gamma>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (?\<Gamma>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> pred P |` {v. local.stable (add_anno_stable \<S> upd) v} mem\<^sub>1
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>2 = (mds AsmNoWrite, mds AsmNoReadOrWrite)
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> anno_type_sec \<Gamma> ?\<S>2 ?P2 upd
 4. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>''2 = add_anno_stable ?\<S>2 upd
 5. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> type_stable ?\<S>2 ?P2
 6. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> P |` {v. local.stable (add_anno_stable \<S> upd) v} = ?P2 |` {v. local.stable ?\<S>''2 v}
 7. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>?\<S>2 upd
 8. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using anno_type pred
[PROOF STATE]
proof (prove)
using this:
\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd
\<S>' = add_anno_stable \<S> upd
P' = P |` {v. local.stable \<S>' v}
\<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
c \<noteq> Stop
to_total \<Gamma> ?x5 \<le>:\<^sub>P' to_total \<Gamma>' ?x5
anno_type_stable \<Gamma> \<S> upd
anno_type_sec \<Gamma> \<S> P upd
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1

goal (8 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> pred P |` {v. local.stable (add_anno_stable \<S> upd) v} mem\<^sub>1
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>2 = (mds AsmNoWrite, mds AsmNoReadOrWrite)
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> anno_type_sec \<Gamma> ?\<S>2 ?P2 upd
 4. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>''2 = add_anno_stable ?\<S>2 upd
 5. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> type_stable ?\<S>2 ?P2
 6. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> P |` {v. local.stable (add_anno_stable \<S> upd) v} = ?P2 |` {v. local.stable ?\<S>''2 v}
 7. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>?\<S>2 upd
 8. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>2 = (mds AsmNoWrite, mds AsmNoReadOrWrite)
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> anno_type_sec \<Gamma> ?\<S>2 ?P2 upd
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>''2 = add_anno_stable ?\<S>2 upd
 4. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> type_stable ?\<S>2 ?P2
 5. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> P |` {v. local.stable (add_anno_stable \<S> upd) v} = ?P2 |` {v. local.stable ?\<S>''2 v}
 6. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>?\<S>2 upd
 7. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using anno_type
[PROOF STATE]
proof (prove)
using this:
\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd
\<S>' = add_anno_stable \<S> upd
P' = P |` {v. local.stable \<S>' v}
\<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
c \<noteq> Stop
to_total \<Gamma> ?x5 \<le>:\<^sub>P' to_total \<Gamma>' ?x5
anno_type_stable \<Gamma> \<S> upd
anno_type_sec \<Gamma> \<S> P upd
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (7 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>2 = (mds AsmNoWrite, mds AsmNoReadOrWrite)
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> anno_type_sec \<Gamma> ?\<S>2 ?P2 upd
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>''2 = add_anno_stable ?\<S>2 upd
 4. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> type_stable ?\<S>2 ?P2
 5. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> P |` {v. local.stable (add_anno_stable \<S> upd) v} = ?P2 |` {v. local.stable ?\<S>''2 v}
 6. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>?\<S>2 upd
 7. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> anno_type_sec \<Gamma> (mds AsmNoWrite, mds AsmNoReadOrWrite) ?P2 upd
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>''2 = add_anno_stable (mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> type_stable (mds AsmNoWrite, mds AsmNoReadOrWrite) ?P2
 4. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> P |` {v. local.stable (add_anno_stable \<S> upd) v} = ?P2 |` {v. local.stable ?\<S>''2 v}
 5. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>(mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 6. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using anno_type
[PROOF STATE]
proof (prove)
using this:
\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd
\<S>' = add_anno_stable \<S> upd
P' = P |` {v. local.stable \<S>' v}
\<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
c \<noteq> Stop
to_total \<Gamma> ?x5 \<le>:\<^sub>P' to_total \<Gamma>' ?x5
anno_type_stable \<Gamma> \<S> upd
anno_type_sec \<Gamma> \<S> P upd
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (6 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> anno_type_sec \<Gamma> (mds AsmNoWrite, mds AsmNoReadOrWrite) ?P2 upd
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>''2 = add_anno_stable (mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> type_stable (mds AsmNoWrite, mds AsmNoReadOrWrite) ?P2
 4. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> P |` {v. local.stable (add_anno_stable \<S> upd) v} = ?P2 |` {v. local.stable ?\<S>''2 v}
 5. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>(mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 6. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(fastforce simp: tyenv_wellformed_def mds_consistent_def)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>''2 = add_anno_stable (mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> type_stable (mds AsmNoWrite, mds AsmNoReadOrWrite) P
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> P |` {v. local.stable (add_anno_stable \<S> upd) v} = P |` {v. local.stable ?\<S>''2 v}
 4. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>(mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 5. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using anno_type
[PROOF STATE]
proof (prove)
using this:
\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd
\<S>' = add_anno_stable \<S> upd
P' = P |` {v. local.stable \<S>' v}
\<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
c \<noteq> Stop
to_total \<Gamma> ?x5 \<le>:\<^sub>P' to_total \<Gamma>' ?x5
anno_type_stable \<Gamma> \<S> upd
anno_type_sec \<Gamma> \<S> P upd
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (5 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> ?\<S>''2 = add_anno_stable (mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> type_stable (mds AsmNoWrite, mds AsmNoReadOrWrite) P
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> P |` {v. local.stable (add_anno_stable \<S> upd) v} = P |` {v. local.stable ?\<S>''2 v}
 4. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>(mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 5. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> type_stable (mds AsmNoWrite, mds AsmNoReadOrWrite) P
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> P |` {v. local.stable (add_anno_stable \<S> upd) v} = P |` {v. local.stable (add_anno_stable (mds AsmNoWrite, mds AsmNoReadOrWrite) upd) v}
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>(mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 4. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(fastforce simp: tyenv_wellformed_def mds_consistent_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> P |` {v. local.stable (add_anno_stable \<S> upd) v} = P |` {v. local.stable (add_anno_stable (mds AsmNoWrite, mds AsmNoReadOrWrite) upd) v}
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>(mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 3. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(fastforce simp: tyenv_wellformed_def mds_consistent_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>(mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using anno_type
[PROOF STATE]
proof (prove)
using this:
\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd
\<S>' = add_anno_stable \<S> upd
P' = P |` {v. local.stable \<S>' v}
\<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
c \<noteq> Stop
to_total \<Gamma> ?x5 \<le>:\<^sub>P' to_total \<Gamma>' ?x5
anno_type_stable \<Gamma> \<S> upd
anno_type_sec \<Gamma> \<S> P upd
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (2 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<Gamma>' = \<Gamma> \<oplus>\<^sub>(mds AsmNoWrite, mds AsmNoReadOrWrite) upd
 2. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(fastforce simp: tyenv_wellformed_def mds_consistent_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>'. x \<notin> update_modes upd mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)

goal (10 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed (update_modes upd mds) \<Gamma>' \<S>' P'
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1
tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>'. x \<notin> update_modes upd mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
[PROOF STEP]
obtain c\<^sub>2' mem\<^sub>2' where "(\<langle>c, update_modes upd mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and>
    \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>)"
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed (update_modes upd mds) \<Gamma>' \<S>' P'
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1
tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>'. x \<notin> update_modes upd mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)

goal (1 subgoal):
 1. (\<And>c\<^sub>2' mem\<^sub>2'. \<langle>c, update_modes upd mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using anno_type
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed (update_modes upd mds) \<Gamma>' \<S>' P'
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1
tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>'. x \<notin> update_modes upd mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd
\<S>' = add_anno_stable \<S> upd
P' = P |` {v. local.stable \<S>' v}
\<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
c \<noteq> Stop
to_total \<Gamma> ?x5 \<le>:\<^sub>P' to_total \<Gamma>' ?x5
anno_type_stable \<Gamma> \<S> upd
anno_type_sec \<Gamma> \<S> P upd
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. (\<And>c\<^sub>2' mem\<^sub>2'. \<langle>c, update_modes upd mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>c\<^sub>2' mem\<^sub>2'. \<langle>c, update_modes upd mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<Longrightarrow> thesis; tyenv_wellformed (update_modes upd mds) \<Gamma> \<oplus>\<^sub>\<S> upd (add_anno_stable \<S> upd) P |` Collect (local.stable (add_anno_stable \<S> upd)); pred P |` Collect (local.stable (add_anno_stable \<S> upd)) mem\<^sub>1; \<forall>x\<in>dom \<Gamma> \<oplus>\<^sub>\<S> upd. x \<notin> update_modes upd mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> \<oplus>\<^sub>\<S> upd x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable (add_anno_stable \<S> upd) v}; \<turnstile> \<Gamma> \<oplus>\<^sub>\<S> upd,add_anno_stable \<S> upd,P |` {v. local.stable (add_anno_stable \<S> upd) v} {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<oplus>\<^sub>\<S> upd (add_anno_stable \<S> upd) P |` {v. local.stable (add_anno_stable \<S> upd) v}; mem\<^sub>1 =\<^bsub>\<Gamma> \<oplus>\<^sub>\<S> upd\<^esub> mem\<^sub>2; pred P |` Collect (local.stable (add_anno_stable \<S> upd)) mem\<^sub>2; \<forall>x\<in>dom \<Gamma> \<oplus>\<^sub>\<S> upd. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> \<oplus>\<^sub>\<S> upd x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P |` {v. local.stable (add_anno_stable \<S> upd) v} to_total \<Gamma> \<oplus>\<^sub>\<S> upd x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
using \<open>mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2\<close> local.pred_def restrict_preds_to_vars_def upd_elim
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2
pred ?P \<equiv> \<lambda>mem. \<forall>p\<in>?P. ev\<^sub>B mem p
?P |` ?V \<equiv> {e \<in> ?P. bexp_vars e \<subseteq> ?V}
\<langle>?c@[?upd], ?mds, ?mem\<rangle> \<leadsto> \<langle>?c', ?mds', ?mem'\<rangle> \<Longrightarrow> \<langle>?c, update_modes ?upd ?mds, ?mem\<rangle> \<leadsto> \<langle>?c', ?mds', ?mem'\<rangle>

goal (1 subgoal):
 1. \<lbrakk>\<And>c\<^sub>2' mem\<^sub>2'. \<langle>c, update_modes upd mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<Longrightarrow> thesis; tyenv_wellformed (update_modes upd mds) \<Gamma> \<oplus>\<^sub>\<S> upd (add_anno_stable \<S> upd) P |` Collect (local.stable (add_anno_stable \<S> upd)); pred P |` Collect (local.stable (add_anno_stable \<S> upd)) mem\<^sub>1; \<forall>x\<in>dom \<Gamma> \<oplus>\<^sub>\<S> upd. x \<notin> update_modes upd mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> \<oplus>\<^sub>\<S> upd x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable (add_anno_stable \<S> upd) v}; \<turnstile> \<Gamma> \<oplus>\<^sub>\<S> upd,add_anno_stable \<S> upd,P |` {v. local.stable (add_anno_stable \<S> upd) v} {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<oplus>\<^sub>\<S> upd (add_anno_stable \<S> upd) P |` {v. local.stable (add_anno_stable \<S> upd) v}; mem\<^sub>1 =\<^bsub>\<Gamma> \<oplus>\<^sub>\<S> upd\<^esub> mem\<^sub>2; pred P |` Collect (local.stable (add_anno_stable \<S> upd)) mem\<^sub>2; \<forall>x\<in>dom \<Gamma> \<oplus>\<^sub>\<S> upd. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> \<oplus>\<^sub>\<S> upd x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P |` {v. local.stable (add_anno_stable \<S> upd) v} to_total \<Gamma> \<oplus>\<^sub>\<S> upd x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<langle>c, update_modes upd mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (10 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>' \<Gamma> \<S> upd \<S>' P' P c \<Gamma>'' \<S>'' P'' mds c\<^sub>1'. \<lbrakk>\<Gamma>' = \<Gamma> \<oplus>\<^sub>\<S> upd; \<S>' = add_anno_stable \<S> upd; P' = P |` {v. local.stable \<S>' v}; \<turnstile> \<Gamma>',\<S>',P' {c} \<Gamma>'',\<S>'',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>' \<S>' P'; mem\<^sub>1 =\<^bsub>\<Gamma>'\<^esub> mem\<^sub>2; pred P' mem\<^sub>1; pred P' mem\<^sub>2; \<forall>x\<in>dom \<Gamma>'. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>' x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; c \<noteq> Stop; \<And>x. to_total \<Gamma> x \<le>:\<^sub>P' to_total \<Gamma>' x; anno_type_stable \<Gamma> \<S> upd; anno_type_sec \<Gamma> \<S> P upd; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c@[upd], mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 10. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<langle>c, update_modes upd mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
apply (rule_tac x = c\<^sub>2' in exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>c, update_modes upd mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<Longrightarrow> \<exists>mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
apply (rule_tac x = mem\<^sub>2' in exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>c, update_modes upd mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<Longrightarrow> \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<langle>c, update_modes upd mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>\<rbrakk> \<Longrightarrow> \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by (metis cxt_to_stmt.simps(1) eval\<^sub>w.decl)
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c@[upd], mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>'',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (9 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
case stop_type
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma>_ \<S>_ P_
mem\<^sub>1 =\<^bsub>\<Gamma>_\<^esub> mem\<^sub>2
pred P_ mem\<^sub>1
pred P_ mem\<^sub>2
\<forall>x\<in>dom \<Gamma>_. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>_ x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (9 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 9. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
with stop_no_eval
[PROOF STATE]
proof (chain)
picking this:
(\<langle>Stop, ?mds, ?mem\<rangle>, \<langle>?c', ?mds', ?mem'\<rangle>) \<notin> eval\<^sub>w
tyenv_wellformed mds \<Gamma>_ \<S>_ P_
mem\<^sub>1 =\<^bsub>\<Gamma>_\<^esub> mem\<^sub>2
pred P_ mem\<^sub>1
pred P_ mem\<^sub>2
\<forall>x\<in>dom \<Gamma>_. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>_ x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(\<langle>Stop, ?mds, ?mem\<rangle>, \<langle>?c', ?mds', ?mem'\<rangle>) \<notin> eval\<^sub>w
tyenv_wellformed mds \<Gamma>_ \<S>_ P_
mem\<^sub>1 =\<^bsub>\<Gamma>_\<^esub> mem\<^sub>2
pred P_ mem\<^sub>1
pred P_ mem\<^sub>2
\<forall>x\<in>dom \<Gamma>_. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>_ x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Stop, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>_,\<S>_,P_\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stop, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>_,\<S>_,P_\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (8 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
case (skip_type \<Gamma> \<S> P mds)
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (8 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (8 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
with skip_type
[PROOF STATE]
proof (chain)
picking this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
[PROOF STEP]
have [simp]: "mds' = mds" "c\<^sub>1' = Stop" "mem\<^sub>1' = mem\<^sub>1"
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. mds' = mds &&& c\<^sub>1' = Stop &&& mem\<^sub>1' = mem\<^sub>1
[PROOF STEP]
using skip_elim
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
\<langle>Skip, ?mds, ?mem\<rangle> \<leadsto> \<langle>?c', ?mds', ?mem'\<rangle> \<Longrightarrow> ?c' = Stop \<and> ?mds = ?mds' \<and> ?mem = ?mem'

goal (1 subgoal):
 1. mds' = mds &&& c\<^sub>1' = Stop &&& mem\<^sub>1' = mem\<^sub>1
[PROOF STEP]
by (metis, metis, metis)
[PROOF STATE]
proof (state)
this:
mds' = mds
c\<^sub>1' = Stop
mem\<^sub>1' = mem\<^sub>1

goal (8 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
with skip_type
[PROOF STATE]
proof (chain)
picking this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
mds' = mds
c\<^sub>1' = Stop
mem\<^sub>1' = mem\<^sub>1
[PROOF STEP]
have "\<langle>Stop, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>Stop, mds, mem\<^sub>2\<rangle>"
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
mds' = mds
c\<^sub>1' = Stop
mem\<^sub>1' = mem\<^sub>1

goal (1 subgoal):
 1. \<langle>Stop, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>Stop, mds, mem\<^sub>2\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>Stop, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>Stop, mds, mem\<^sub>2\<rangle>

goal (8 subgoals):
 1. \<And>\<Gamma> \<S> P mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Skip, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 8. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<langle>Stop, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>Stop, mds, mem\<^sub>2\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
using \<R>.intro\<^sub>1 and unannotated [where c = Skip and E = "[]"]
[PROOF STATE]
proof (prove)
using this:
\<langle>Stop, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>Stop, mds, mem\<^sub>2\<rangle>
(case ?lc of (x, xa) \<Rightarrow> (case x of (x, xa) \<Rightarrow> \<lambda>xb ((xc, xd), xe). \<langle>x, xa, xb\<rangle> \<R>\<^sup>1\<^bsub>?\<Gamma>,?\<S>,?P\<^esub> \<langle>xc, xd, xe\<rangle>) xa) ?lc' \<Longrightarrow> ?lc \<R>\<^sup>u\<^bsub>?\<Gamma>,?\<S>,?P\<^esub> ?lc'
eval\<^sub>w_simple_abv (Skip, ?mem) (?c', ?mem') \<Longrightarrow> \<langle>cxt_to_stmt [] Skip, ?mds, ?mem\<rangle> \<leadsto> \<langle>cxt_to_stmt [] ?c', ?mds, ?mem'\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<langle>Stop, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>Stop, mds, mem\<^sub>2\<rangle>; \<And>\<Gamma> a b P aa ba bb ab bc bd. \<langle>aa, ba, bb\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,(a, b),P\<^esub> \<langle>ab, bc, bd\<rangle> \<Longrightarrow> \<langle>aa, ba, bb\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,(a, b),P\<^esub> \<langle>ab, bc, bd\<rangle>; \<And>mem c' mem' mds. eval\<^sub>w_simple_abv (Skip, mem) (c', mem') \<Longrightarrow> \<langle>Skip, mds, mem\<rangle> \<leadsto> \<langle>c', mds, mem'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds, mem\<^sub>2'\<rangle> \<and> \<langle>Stop, mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds, mem\<^sub>2'\<rangle>
[PROOF STEP]
by (metis (mono_tags, lifting) \<R>.intro\<^sub>1 old.prod.case skip_eval\<^sub>w)
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Skip, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
(* assign\<^sub>1 *)
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
case (assign\<^sub>1 x \<Gamma> e t P P' \<S> mds)
[PROOF STATE]
proof (state)
this:
x \<notin> dom \<Gamma>
x \<notin> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
t \<le>:\<^sub>P dma_type x
P' = assign_post P x e |` {v. local.stable \<S> v}
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
hence upd [simp]: "c\<^sub>1' = Stop" "mds' = mds" "mem\<^sub>1' = mem\<^sub>1 (x := ev\<^sub>A mem\<^sub>1 e)"
[PROOF STATE]
proof (prove)
using this:
x \<notin> dom \<Gamma>
x \<notin> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
t \<le>:\<^sub>P dma_type x
P' = assign_post P x e |` {v. local.stable \<S> v}
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. c\<^sub>1' = Stop &&& mds' = mds &&& mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
[PROOF STEP]
using assign_elim
[PROOF STATE]
proof (prove)
using this:
x \<notin> dom \<Gamma>
x \<notin> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
t \<le>:\<^sub>P dma_type x
P' = assign_post P x e |` {v. local.stable \<S> v}
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
\<langle>?x \<leftarrow> ?e, ?mds, ?mem\<rangle> \<leadsto> \<langle>?c', ?mds', ?mem'\<rangle> \<Longrightarrow> ?c' = Stop \<and> ?mds = ?mds' \<and> ?mem' = ?mem(?x := ev\<^sub>A ?mem ?e)

goal (1 subgoal):
 1. c\<^sub>1' = Stop &&& mds' = mds &&& mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
[PROOF STEP]
by (auto, metis)
[PROOF STATE]
proof (state)
this:
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from assign\<^sub>1(2) upd
[PROOF STATE]
proof (chain)
picking this:
x \<notin> \<C>
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
[PROOF STEP]
have \<C>_eq: "\<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x"
[PROOF STATE]
proof (prove)
using this:
x \<notin> \<C>
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have dma_eq [simp]: "dma mem\<^sub>1 = dma mem\<^sub>1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dma mem\<^sub>1 = dma mem\<^sub>1'
[PROOF STEP]
using dma_\<C> assign\<^sub>1(2)
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>\<C>. ?mem\<^sub>1 x = ?mem\<^sub>2 x \<Longrightarrow> dma ?mem\<^sub>1 = dma ?mem\<^sub>2
x \<notin> \<C>

goal (1 subgoal):
 1. dma mem\<^sub>1 = dma mem\<^sub>1'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dma mem\<^sub>1 = dma mem\<^sub>1'

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "mem\<^sub>1 (x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2 (x := ev\<^sub>A mem\<^sub>2 e)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)
[PROOF STEP]
unfolding tyenv_eq_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>xa. type_max (to_total \<Gamma> xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
proof(clarify)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa. type_max (to_total \<Gamma> xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa. type_max (to_total \<Gamma> xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
assume is_Low': "type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low"
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low

goal (1 subgoal):
 1. \<And>xa. type_max (to_total \<Gamma> xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
show "(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
proof(cases "v \<in> dom \<Gamma>")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume [simp]: "v \<in> dom \<Gamma>"
[PROOF STATE]
proof (state)
this:
v \<in> dom \<Gamma>

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
v \<in> dom \<Gamma>
[PROOF STEP]
obtain t' where [simp]: "\<Gamma> v = Some t'"
[PROOF STATE]
proof (prove)
using this:
v \<in> dom \<Gamma>

goal (1 subgoal):
 1. (\<And>t'. \<Gamma> v = Some t' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
\<Gamma> v = Some t'

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
hence [simp]: "(to_total \<Gamma> v) = t'"
[PROOF STATE]
proof (prove)
using this:
\<Gamma> v = Some t'

goal (1 subgoal):
 1. to_total \<Gamma> v = t'
[PROOF STEP]
unfolding to_total_def
[PROOF STATE]
proof (prove)
using this:
\<Gamma> v = Some t'

goal (1 subgoal):
 1. (if v \<in> dom \<Gamma> then the (\<Gamma> v) else dma_type v) = t'
[PROOF STEP]
by (auto split: if_splits)
[PROOF STATE]
proof (state)
this:
to_total \<Gamma> v = t'

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
have "type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
[PROOF STEP]
apply(rule \<C>_eq_type_max_eq)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. type_wellformed t'
 2. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
using \<open>\<Gamma> v = Some t'\<close> assign\<^sub>1(6)
[PROOF STATE]
proof (prove)
using this:
\<Gamma> v = Some t'
tyenv_wellformed mds \<Gamma> \<S> P

goal (2 subgoals):
 1. type_wellformed t'
 2. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
unfolding tyenv_wellformed_def types_wellformed_def
[PROOF STATE]
proof (prove)
using this:
\<Gamma> v = Some t'
mds_consistent mds \<Gamma> \<S> P \<and> (\<forall>x\<in>dom \<Gamma>. type_wellformed (the (\<Gamma> x))) \<and> types_stable \<Gamma> \<S>

goal (2 subgoals):
 1. type_wellformed t'
 2. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
apply (metis \<open>v \<in> dom \<Gamma>\<close> option.sel)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
using assign\<^sub>1(2)
[PROOF STATE]
proof (prove)
using this:
x \<notin> \<C>

goal (1 subgoal):
 1. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with is_Low'
[PROOF STATE]
proof (chain)
picking this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
[PROOF STEP]
have is_Low: "type_max (to_total \<Gamma> v) mem\<^sub>1 = Low"
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'

goal (1 subgoal):
 1. type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
from assign\<^sub>1(1) \<open>v \<in> dom \<Gamma>\<close>
[PROOF STATE]
proof (chain)
picking this:
x \<notin> dom \<Gamma>
v \<in> dom \<Gamma>
[PROOF STEP]
have "x \<noteq> v"
[PROOF STATE]
proof (prove)
using this:
x \<notin> dom \<Gamma>
v \<in> dom \<Gamma>

goal (1 subgoal):
 1. x \<noteq> v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<noteq> v

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x \<noteq> v

goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
using is_Low assign\<^sub>1(7)
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2

goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
unfolding tyenv_eq_def
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
\<forall>x. type_max (to_total \<Gamma> x) mem\<^sub>1 = Low \<longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x

goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume "v \<notin> dom \<Gamma>"
[PROOF STATE]
proof (state)
this:
v \<notin> dom \<Gamma>

goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
hence [simp]: "\<And>mem. type_max (to_total \<Gamma> v) mem = dma mem v"
[PROOF STATE]
proof (prove)
using this:
v \<notin> dom \<Gamma>

goal (1 subgoal):
 1. \<And>mem. type_max (to_total \<Gamma> v) mem = dma mem v
[PROOF STEP]
unfolding to_total_def
[PROOF STATE]
proof (prove)
using this:
v \<notin> dom \<Gamma>

goal (1 subgoal):
 1. \<And>mem. type_max (if v \<in> dom \<Gamma> then the (\<Gamma> v) else dma_type v) mem = dma mem v
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> v) ?mem5 = dma ?mem5 v

goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with is_Low'
[PROOF STATE]
proof (chain)
picking this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
type_max (to_total \<Gamma> v) ?mem5 = dma ?mem5 v
[PROOF STEP]
have "dma mem\<^sub>1' v = Low"
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
type_max (to_total \<Gamma> v) ?mem5 = dma ?mem5 v

goal (1 subgoal):
 1. dma mem\<^sub>1' v = Low
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dma mem\<^sub>1' v = Low

goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with dma_eq
[PROOF STATE]
proof (chain)
picking this:
dma mem\<^sub>1 = dma mem\<^sub>1'
dma mem\<^sub>1' v = Low
[PROOF STEP]
have dma_v_Low: "dma mem\<^sub>1 v = Low"
[PROOF STATE]
proof (prove)
using this:
dma mem\<^sub>1 = dma mem\<^sub>1'
dma mem\<^sub>1' v = Low

goal (1 subgoal):
 1. dma mem\<^sub>1 v = Low
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dma mem\<^sub>1 v = Low

goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
hence is_Low: "type_max (to_total \<Gamma> v) mem\<^sub>1 = Low"
[PROOF STATE]
proof (prove)
using this:
dma mem\<^sub>1 v = Low

goal (1 subgoal):
 1. type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low

goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
proof(cases "x = v")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x = v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. x \<noteq> v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume "x \<noteq> v"
[PROOF STATE]
proof (state)
this:
x \<noteq> v

goal (2 subgoals):
 1. x = v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. x \<noteq> v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x \<noteq> v

goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
using is_Low assign\<^sub>1(7)
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2

goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
unfolding tyenv_eq_def
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
\<forall>x. type_max (to_total \<Gamma> x) mem\<^sub>1 = Low \<longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x

goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal (1 subgoal):
 1. x = v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x = v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume "x = v"
[PROOF STATE]
proof (state)
this:
x = v

goal (1 subgoal):
 1. x = v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x = v

goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = v \<Longrightarrow> ev\<^sub>A mem\<^sub>1 e = ev\<^sub>A mem\<^sub>2 e
[PROOF STEP]
apply(rule ev\<^sub>A_eq)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. x = v \<Longrightarrow> mem\<^sub>1 =\<^bsub>?\<Gamma>2\<^esub> mem\<^sub>2
 2. x = v \<Longrightarrow> pred ?P2 mem\<^sub>1
 3. x = v \<Longrightarrow> ?\<Gamma>2 \<turnstile>\<^sub>a e \<in> ?t2
 4. x = v \<Longrightarrow> ?t2 \<le>:\<^sub>?P2 dma_type ?v2
 5. x = v \<Longrightarrow> dma mem\<^sub>1 ?v2 = Low
[PROOF STEP]
apply(rule assign\<^sub>1(7))
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. x = v \<Longrightarrow> pred ?P2 mem\<^sub>1
 2. x = v \<Longrightarrow> \<Gamma> \<turnstile>\<^sub>a e \<in> ?t2
 3. x = v \<Longrightarrow> ?t2 \<le>:\<^sub>?P2 dma_type ?v2
 4. x = v \<Longrightarrow> dma mem\<^sub>1 ?v2 = Low
[PROOF STEP]
apply(rule assign\<^sub>1(8))
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. x = v \<Longrightarrow> \<Gamma> \<turnstile>\<^sub>a e \<in> ?t2
 2. x = v \<Longrightarrow> ?t2 \<le>:\<^sub>P dma_type ?v2
 3. x = v \<Longrightarrow> dma mem\<^sub>1 ?v2 = Low
[PROOF STEP]
apply(rule assign\<^sub>1(3))
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. x = v \<Longrightarrow> t \<le>:\<^sub>P dma_type ?v2
 2. x = v \<Longrightarrow> dma mem\<^sub>1 ?v2 = Low
[PROOF STEP]
apply(rule assign\<^sub>1(4))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = v \<Longrightarrow> dma mem\<^sub>1 x = Low
[PROOF STEP]
using dma_v_Low
[PROOF STATE]
proof (prove)
using this:
dma mem\<^sub>1 v = Low

goal (1 subgoal):
 1. x = v \<Longrightarrow> dma mem\<^sub>1 x = Low
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'
[PROOF STEP]
using upd tyenv_wellformed_preds_update assign\<^sub>1
[PROOF STATE]
proof (prove)
using this:
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
\<lbrakk>?P' = ?P'' |` {v. local.stable ?\<S> v}; tyenv_wellformed ?mds ?\<Gamma> ?\<S> ?P\<rbrakk> \<Longrightarrow> tyenv_wellformed ?mds ?\<Gamma> ?\<S> ?P'
x \<notin> dom \<Gamma>
x \<notin> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
t \<le>:\<^sub>P dma_type x
P' = assign_post P x e |` {v. local.stable \<S> v}
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
[PROOF STEP]
using pred_preds_update assign\<^sub>1 upd
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?mem' = ?mem(?x := ev\<^sub>A ?mem ?e); ?P' = assign_post ?P ?x ?e |` {v. local.stable ?\<S> v}; pred ?P ?mem\<rbrakk> \<Longrightarrow> pred ?P' ?mem'
x \<notin> dom \<Gamma>
x \<notin> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
t \<le>:\<^sub>P dma_type x
P' = assign_post P x e |` {v. local.stable \<S> v}
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
[PROOF STEP]
using pred_preds_update assign\<^sub>1 upd
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?mem' = ?mem(?x := ev\<^sub>A ?mem ?e); ?P' = assign_post ?P ?x ?e |` {v. local.stable ?\<S> v}; pred ?P ?mem\<rbrakk> \<Longrightarrow> pred ?P' ?mem'
x \<notin> dom \<Gamma>
x \<notin> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
t \<le>:\<^sub>P dma_type x
P' = assign_post P x e |` {v. local.stable \<S> v}
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "tyenv_wellformed mds \<Gamma> \<S> P  \<and> tyenv_sec mds \<Gamma> mem\<^sub>1 \<longrightarrow> tyenv_sec mds \<Gamma> mem\<^sub>1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x)
[PROOF STEP]
using tyenv_sec_eq[OF \<C>_eq, where \<Gamma>=\<Gamma>]
[PROOF STATE]
proof (prove)
using this:
types_wellformed \<Gamma> \<Longrightarrow> (\<forall>x\<in>dom \<Gamma>. x \<notin> ?mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) = (\<forall>x\<in>dom \<Gamma>. x \<notin> ?mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x)

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x)
[PROOF STEP]
unfolding tyenv_wellformed_def
[PROOF STATE]
proof (prove)
using this:
types_wellformed \<Gamma> \<Longrightarrow> (\<forall>x\<in>dom \<Gamma>. x \<notin> ?mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) = (\<forall>x\<in>dom \<Gamma>. x \<notin> ?mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x)

goal (1 subgoal):
 1. (mds_consistent mds \<Gamma> \<S> P \<and> types_wellformed \<Gamma> \<and> types_stable \<Gamma> \<S>) \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x)

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
tyenv_wellformed mds \<Gamma> \<S> P \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x)
[PROOF STEP]
have \<R>':
    "\<langle>Stop, mds', mem\<^sub>1 (x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2 (x := ev\<^sub>A mem\<^sub>2 e)\<rangle>"
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
tyenv_wellformed mds \<Gamma> \<S> P \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x)

goal (1 subgoal):
 1. \<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e); tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'; pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'; pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)); tyenv_wellformed mds \<Gamma> \<S> P \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<longrightarrow> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x)\<rbrakk> \<Longrightarrow> \<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
apply (rule \<R>.intro\<^sub>1, auto simp: assign\<^sub>1 simp del: dma_eq)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have a: "\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2 (x := ev\<^sub>A mem\<^sub>2 e)\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
by (auto, metis cxt_to_stmt.simps(1) eval\<^sub>w.unannotated eval\<^sub>w_simple.assign)
[PROOF STATE]
proof (state)
this:
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (7 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<notin> dom \<Gamma>; x \<notin> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; t \<le>:\<^sub>P dma_type x; P' = assign_post P x e |` {v. local.stable \<S> v}; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 7. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from \<R>' a
[PROOF STATE]
proof (chain)
picking this:
\<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
using \<open>c\<^sub>1' = Stop\<close> and \<open>mem\<^sub>1' = mem\<^sub>1 (x := ev\<^sub>A mem\<^sub>1 e)\<close>
[PROOF STATE]
proof (prove)
using this:
\<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
c\<^sub>1' = Stop
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
(* assign\<^sub>\<C> *)
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
case (assign\<^sub>\<C> x \<Gamma> e t P P' \<S> mds)
[PROOF STATE]
proof (state)
this:
x \<in> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
P \<turnstile> t
\<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v))
P' = assign_post P x e |` {v. local.stable \<S> v}
\<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
hence upd [simp]: "c\<^sub>1' = Stop" "mds' = mds" "mem\<^sub>1' = mem\<^sub>1 (x := ev\<^sub>A mem\<^sub>1 e)"
[PROOF STATE]
proof (prove)
using this:
x \<in> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
P \<turnstile> t
\<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v))
P' = assign_post P x e |` {v. local.stable \<S> v}
\<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. c\<^sub>1' = Stop &&& mds' = mds &&& mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
[PROOF STEP]
using assign_elim
[PROOF STATE]
proof (prove)
using this:
x \<in> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
P \<turnstile> t
\<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v))
P' = assign_post P x e |` {v. local.stable \<S> v}
\<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
\<langle>?x \<leftarrow> ?e, ?mds, ?mem\<rangle> \<leadsto> \<langle>?c', ?mds', ?mem'\<rangle> \<Longrightarrow> ?c' = Stop \<and> ?mds = ?mds' \<and> ?mem' = ?mem(?x := ev\<^sub>A ?mem ?e)

goal (1 subgoal):
 1. c\<^sub>1' = Stop &&& mds' = mds &&& mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
[PROOF STEP]
by (auto, metis)
[PROOF STATE]
proof (state)
this:
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "mem\<^sub>1 (x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2 (x := ev\<^sub>A mem\<^sub>2 e)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)
[PROOF STEP]
unfolding tyenv_eq_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>xa. type_max (to_total \<Gamma> xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
proof(clarify)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa. type_max (to_total \<Gamma> xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa. type_max (to_total \<Gamma> xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
assume is_Low': "type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low"
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low

goal (1 subgoal):
 1. \<And>xa. type_max (to_total \<Gamma> xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
show "(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
proof(cases "v \<in> dom \<Gamma>")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume in_dom [simp]: "v \<in> dom \<Gamma>"
[PROOF STATE]
proof (state)
this:
v \<in> dom \<Gamma>

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
v \<in> dom \<Gamma>
[PROOF STEP]
obtain t' where \<Gamma>v [simp]: "\<Gamma> v = Some t'"
[PROOF STATE]
proof (prove)
using this:
v \<in> dom \<Gamma>

goal (1 subgoal):
 1. (\<And>t'. \<Gamma> v = Some t' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
\<Gamma> v = Some t'

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
hence [simp]: "(to_total \<Gamma> v) = t'"
[PROOF STATE]
proof (prove)
using this:
\<Gamma> v = Some t'

goal (1 subgoal):
 1. to_total \<Gamma> v = t'
[PROOF STEP]
unfolding to_total_def
[PROOF STATE]
proof (prove)
using this:
\<Gamma> v = Some t'

goal (1 subgoal):
 1. (if v \<in> dom \<Gamma> then the (\<Gamma> v) else dma_type v) = t'
[PROOF STEP]
by (auto split: if_splits)
[PROOF STATE]
proof (state)
this:
to_total \<Gamma> v = t'

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
from assign\<^sub>\<C>(4)
[PROOF STATE]
proof (chain)
picking this:
\<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v))
[PROOF STEP]
have x_nin_C: "x \<notin> vars_of_type t'"
[PROOF STATE]
proof (prove)
using this:
\<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v))

goal (1 subgoal):
 1. x \<notin> vars_of_type t'
[PROOF STEP]
using in_dom \<Gamma>v
[PROOF STATE]
proof (prove)
using this:
\<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v))
v \<in> dom \<Gamma>
\<Gamma> v = Some t'

goal (1 subgoal):
 1. x \<notin> vars_of_type t'
[PROOF STEP]
by (metis option.sel snd_conv)
[PROOF STATE]
proof (state)
this:
x \<notin> vars_of_type t'

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
have \<Gamma>v_wf: "type_wellformed t'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. type_wellformed t'
[PROOF STEP]
using in_dom \<Gamma>v assign\<^sub>\<C>(7)
[PROOF STATE]
proof (prove)
using this:
v \<in> dom \<Gamma>
\<Gamma> v = Some t'
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. type_wellformed t'
[PROOF STEP]
unfolding tyenv_wellformed_def types_wellformed_def
[PROOF STATE]
proof (prove)
using this:
v \<in> dom \<Gamma>
\<Gamma> v = Some t'
mds_consistent mds \<Gamma> \<S> P \<and> (\<forall>x\<in>dom \<Gamma>. type_wellformed (the (\<Gamma> x))) \<and> types_stable \<Gamma> \<S>

goal (1 subgoal):
 1. type_wellformed t'
[PROOF STEP]
by (metis option.sel)
[PROOF STATE]
proof (state)
this:
type_wellformed t'

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with x_nin_C
[PROOF STATE]
proof (chain)
picking this:
x \<notin> vars_of_type t'
type_wellformed t'
[PROOF STEP]
have f_eq: "type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'"
[PROOF STATE]
proof (prove)
using this:
x \<notin> vars_of_type t'
type_wellformed t'

goal (1 subgoal):
 1. type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
[PROOF STEP]
using vars_of_type_eq_type_max_eq
[PROOF STATE]
proof (prove)
using this:
x \<notin> vars_of_type t'
type_wellformed t'
\<forall>x\<in>vars_of_type ?t. ?mem\<^sub>1 x = ?mem\<^sub>2 x \<Longrightarrow> type_max ?t ?mem\<^sub>1 = type_max ?t ?mem\<^sub>2

goal (1 subgoal):
 1. type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with is_Low'
[PROOF STATE]
proof (chain)
picking this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
[PROOF STEP]
have is_Low: "type_max (to_total \<Gamma> v) mem\<^sub>1 = Low"
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'

goal (1 subgoal):
 1. type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
from assign\<^sub>\<C>(1) \<open>v \<in> dom \<Gamma>\<close> assign\<^sub>\<C>(7)
[PROOF STATE]
proof (chain)
picking this:
x \<in> \<C>
v \<in> dom \<Gamma>
tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
have "x \<noteq> v"
[PROOF STATE]
proof (prove)
using this:
x \<in> \<C>
v \<in> dom \<Gamma>
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. x \<noteq> v
[PROOF STEP]
by(auto simp: tyenv_wellformed_def mds_consistent_def)
[PROOF STATE]
proof (state)
this:
x \<noteq> v

goal (2 subgoals):
 1. v \<in> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x \<noteq> v

goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
using is_Low assign\<^sub>\<C>(8)
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2

goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
unfolding tyenv_eq_def
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
\<forall>x. type_max (to_total \<Gamma> x) mem\<^sub>1 = Low \<longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x

goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume nin_dom: "v \<notin> dom \<Gamma>"
[PROOF STATE]
proof (state)
this:
v \<notin> dom \<Gamma>

goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
hence [simp]: "\<And>mem. type_max (to_total \<Gamma> v) mem = dma mem v"
[PROOF STATE]
proof (prove)
using this:
v \<notin> dom \<Gamma>

goal (1 subgoal):
 1. \<And>mem. type_max (to_total \<Gamma> v) mem = dma mem v
[PROOF STEP]
unfolding to_total_def
[PROOF STATE]
proof (prove)
using this:
v \<notin> dom \<Gamma>

goal (1 subgoal):
 1. \<And>mem. type_max (if v \<in> dom \<Gamma> then the (\<Gamma> v) else dma_type v) mem = dma mem v
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> v) ?mem5 = dma ?mem5 v

goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with is_Low'
[PROOF STATE]
proof (chain)
picking this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
type_max (to_total \<Gamma> v) ?mem5 = dma ?mem5 v
[PROOF STEP]
have "dma mem\<^sub>1' v = Low"
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
type_max (to_total \<Gamma> v) ?mem5 = dma ?mem5 v

goal (1 subgoal):
 1. dma mem\<^sub>1' v = Low
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dma mem\<^sub>1' v = Low

goal (1 subgoal):
 1. v \<notin> dom \<Gamma> \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
proof(cases "x = v")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x = v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. x \<noteq> v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume "x = v"
[PROOF STATE]
proof (state)
this:
x = v

goal (2 subgoals):
 1. x = v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. x \<noteq> v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x = v

goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = v \<Longrightarrow> ev\<^sub>A mem\<^sub>1 e = ev\<^sub>A mem\<^sub>2 e
[PROOF STEP]
apply(rule ev\<^sub>A_eq')
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. x = v \<Longrightarrow> mem\<^sub>1 =\<^bsub>?\<Gamma>2\<^esub> mem\<^sub>2
 2. x = v \<Longrightarrow> pred ?P2 mem\<^sub>1
 3. x = v \<Longrightarrow> ?\<Gamma>2 \<turnstile>\<^sub>a e \<in> ?t2
 4. x = v \<Longrightarrow> ?P2 \<turnstile> ?t2
[PROOF STEP]
apply(rule assign\<^sub>\<C>(8))
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. x = v \<Longrightarrow> pred ?P2 mem\<^sub>1
 2. x = v \<Longrightarrow> \<Gamma> \<turnstile>\<^sub>a e \<in> ?t2
 3. x = v \<Longrightarrow> ?P2 \<turnstile> ?t2
[PROOF STEP]
apply(rule assign\<^sub>\<C>(9))
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. x = v \<Longrightarrow> \<Gamma> \<turnstile>\<^sub>a e \<in> ?t2
 2. x = v \<Longrightarrow> P \<turnstile> ?t2
[PROOF STEP]
apply(rule assign\<^sub>\<C>(2))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = v \<Longrightarrow> P \<turnstile> t
[PROOF STEP]
by(rule assign\<^sub>\<C>(3))
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume [simp]: "x \<noteq> v"
[PROOF STATE]
proof (state)
this:
x \<noteq> v

goal (1 subgoal):
 1. x \<noteq> v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
proof(cases "x \<in> \<C>_vars v")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<in> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. x \<notin> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume in_\<C>_vars: "x \<in> \<C>_vars v"
[PROOF STATE]
proof (state)
this:
x \<in> \<C>_vars v

goal (2 subgoals):
 1. x \<in> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. x \<notin> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
hence "v \<notin> \<C>"
[PROOF STATE]
proof (prove)
using this:
x \<in> \<C>_vars v

goal (1 subgoal):
 1. v \<notin> \<C>
[PROOF STEP]
using \<C>_vars_\<C>
[PROOF STATE]
proof (prove)
using this:
x \<in> \<C>_vars v
?x \<in> \<C> \<Longrightarrow> \<C>_vars ?x = {}

goal (1 subgoal):
 1. v \<notin> \<C>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
v \<notin> \<C>

goal (2 subgoals):
 1. x \<in> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. x \<notin> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with nin_dom
[PROOF STATE]
proof (chain)
picking this:
v \<notin> dom \<Gamma>
v \<notin> \<C>
[PROOF STEP]
have "v \<notin> snd \<S>"
[PROOF STATE]
proof (prove)
using this:
v \<notin> dom \<Gamma>
v \<notin> \<C>

goal (1 subgoal):
 1. v \<notin> snd \<S>
[PROOF STEP]
using assign\<^sub>\<C>(7)
[PROOF STATE]
proof (prove)
using this:
v \<notin> dom \<Gamma>
v \<notin> \<C>
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. v \<notin> snd \<S>
[PROOF STEP]
by(auto simp: tyenv_wellformed_def mds_consistent_def stable_def)
[PROOF STATE]
proof (state)
this:
v \<notin> snd \<S>

goal (2 subgoals):
 1. x \<in> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. x \<notin> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with in_\<C>_vars
[PROOF STATE]
proof (chain)
picking this:
x \<in> \<C>_vars v
v \<notin> snd \<S>
[PROOF STEP]
have "P \<turnstile> (to_total \<Gamma> v)"
[PROOF STATE]
proof (prove)
using this:
x \<in> \<C>_vars v
v \<notin> snd \<S>

goal (1 subgoal):
 1. P \<turnstile> to_total \<Gamma> v
[PROOF STEP]
using assign\<^sub>\<C>(6)
[PROOF STATE]
proof (prove)
using this:
x \<in> \<C>_vars v
v \<notin> snd \<S>
\<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v

goal (1 subgoal):
 1. P \<turnstile> to_total \<Gamma> v
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
P \<turnstile> to_total \<Gamma> v

goal (2 subgoals):
 1. x \<in> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. x \<notin> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with assign\<^sub>\<C>(9)
[PROOF STATE]
proof (chain)
picking this:
pred P mem\<^sub>1
P \<turnstile> to_total \<Gamma> v
[PROOF STEP]
have "type_max (to_total \<Gamma> v) mem\<^sub>1 = Low"
[PROOF STATE]
proof (prove)
using this:
pred P mem\<^sub>1
P \<turnstile> to_total \<Gamma> v

goal (1 subgoal):
 1. type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
by(auto simp: type_max_def pred_def pred_entailment_def)
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low

goal (2 subgoals):
 1. x \<in> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. x \<notin> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low

goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
using not_sym[OF \<open>x \<noteq> v\<close>]
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
v \<noteq> x

goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>dma mem\<^sub>1 v = Low; v \<noteq> x\<rbrakk> \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
using assign\<^sub>\<C>(8)
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2

goal (1 subgoal):
 1. \<lbrakk>dma mem\<^sub>1 v = Low; v \<noteq> x\<rbrakk> \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
unfolding tyenv_eq_def
[PROOF STATE]
proof (prove)
using this:
\<forall>x. type_max (to_total \<Gamma> x) mem\<^sub>1 = Low \<longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x

goal (1 subgoal):
 1. \<lbrakk>dma mem\<^sub>1 v = Low; v \<noteq> x\<rbrakk> \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume "x \<notin> \<C>_vars v"
[PROOF STATE]
proof (state)
this:
x \<notin> \<C>_vars v

goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with is_Low'
[PROOF STATE]
proof (chain)
picking this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
x \<notin> \<C>_vars v
[PROOF STEP]
have "dma mem\<^sub>1 v = Low"
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
x \<notin> \<C>_vars v

goal (1 subgoal):
 1. dma mem\<^sub>1 v = Low
[PROOF STEP]
using dma_\<C>_vars \<open>\<And>mem. type_max (to_total \<Gamma> v) mem = dma mem v\<close>
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
x \<notin> \<C>_vars v
\<forall>x\<in>\<C>_vars ?y. ?mem\<^sub>1 x = ?mem\<^sub>2 x \<Longrightarrow> dma ?mem\<^sub>1 ?y = dma ?mem\<^sub>2 ?y
type_max (to_total \<Gamma> v) ?mem = dma ?mem v

goal (1 subgoal):
 1. dma mem\<^sub>1 v = Low
[PROOF STEP]
by (metis fun_upd_other)
[PROOF STATE]
proof (state)
this:
dma mem\<^sub>1 v = Low

goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
dma mem\<^sub>1 v = Low

goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
using not_sym[OF \<open>x \<noteq> v\<close>]
[PROOF STATE]
proof (prove)
using this:
dma mem\<^sub>1 v = Low
v \<noteq> x

goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>dma mem\<^sub>1 v = Low; v \<noteq> x\<rbrakk> \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
using assign\<^sub>\<C>(8)
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2

goal (1 subgoal):
 1. \<lbrakk>dma mem\<^sub>1 v = Low; v \<noteq> x\<rbrakk> \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
unfolding tyenv_eq_def
[PROOF STATE]
proof (prove)
using this:
\<forall>x. type_max (to_total \<Gamma> x) mem\<^sub>1 = Low \<longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x

goal (1 subgoal):
 1. \<lbrakk>dma mem\<^sub>1 v = Low; v \<noteq> x\<rbrakk> \<Longrightarrow> mem\<^sub>1 v = mem\<^sub>2 v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'
[PROOF STEP]
using upd tyenv_wellformed_preds_update assign\<^sub>\<C>
[PROOF STATE]
proof (prove)
using this:
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
\<lbrakk>?P' = ?P'' |` {v. local.stable ?\<S> v}; tyenv_wellformed ?mds ?\<Gamma> ?\<S> ?P\<rbrakk> \<Longrightarrow> tyenv_wellformed ?mds ?\<Gamma> ?\<S> ?P'
x \<in> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
P \<turnstile> t
\<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v))
P' = assign_post P x e |` {v. local.stable \<S> v}
\<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
[PROOF STEP]
using pred_preds_update assign\<^sub>\<C> upd
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?mem' = ?mem(?x := ev\<^sub>A ?mem ?e); ?P' = assign_post ?P ?x ?e |` {v. local.stable ?\<S> v}; pred ?P ?mem\<rbrakk> \<Longrightarrow> pred ?P' ?mem'
x \<in> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
P \<turnstile> t
\<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v))
P' = assign_post P x e |` {v. local.stable \<S> v}
\<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
[PROOF STEP]
using pred_preds_update assign\<^sub>\<C> upd
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?mem' = ?mem(?x := ev\<^sub>A ?mem ?e); ?P' = assign_post ?P ?x ?e |` {v. local.stable ?\<S> v}; pred ?P ?mem\<rbrakk> \<Longrightarrow> pred ?P' ?mem'
x \<in> \<C>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
P \<turnstile> t
\<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v))
P' = assign_post P x e |` {v. local.stable \<S> v}
\<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> tyenv_sec mds \<Gamma> mem\<^sub>1 \<Longrightarrow> tyenv_sec mds' \<Gamma> mem\<^sub>1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds' AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
proof(clarify)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x y. \<lbrakk>\<Gamma> x = Some y; tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; x \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
fix v t'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x y. \<lbrakk>\<Gamma> x = Some y; tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; x \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
assume wf: "tyenv_wellformed mds \<Gamma> \<S> P"
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. \<And>x y. \<lbrakk>\<Gamma> x = Some y; tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; x \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
assume pred: "pred P mem\<^sub>1"
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>1

goal (1 subgoal):
 1. \<And>x y. \<lbrakk>\<Gamma> x = Some y; tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; x \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
hence pred': "pred P' mem\<^sub>1'"
[PROOF STATE]
proof (prove)
using this:
pred P mem\<^sub>1

goal (1 subgoal):
 1. pred P' mem\<^sub>1'
[PROOF STEP]
using \<open>pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'\<close>
[PROOF STATE]
proof (prove)
using this:
pred P mem\<^sub>1
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'

goal (1 subgoal):
 1. pred P' mem\<^sub>1'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
pred P' mem\<^sub>1'

goal (1 subgoal):
 1. \<And>x y. \<lbrakk>\<Gamma> x = Some y; tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; x \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
assume sec: "tyenv_sec mds \<Gamma> mem\<^sub>1"
[PROOF STATE]
proof (state)
this:
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x

goal (1 subgoal):
 1. \<And>x y. \<lbrakk>\<Gamma> x = Some y; tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; x \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
assume \<Gamma>v: "\<Gamma> v = Some t'"
[PROOF STATE]
proof (state)
this:
\<Gamma> v = Some t'

goal (1 subgoal):
 1. \<And>x y. \<lbrakk>\<Gamma> x = Some y; tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; x \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
assume readable': "v \<notin> mds' AsmNoReadOrWrite"
[PROOF STATE]
proof (state)
this:
v \<notin> mds' AsmNoReadOrWrite

goal (1 subgoal):
 1. \<And>x y. \<lbrakk>\<Gamma> x = Some y; tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; x \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
with upd
[PROOF STATE]
proof (chain)
picking this:
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
v \<notin> mds' AsmNoReadOrWrite
[PROOF STEP]
have readable: "v \<notin> mds AsmNoReadOrWrite"
[PROOF STATE]
proof (prove)
using this:
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
v \<notin> mds' AsmNoReadOrWrite

goal (1 subgoal):
 1. v \<notin> mds AsmNoReadOrWrite
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
v \<notin> mds AsmNoReadOrWrite

goal (1 subgoal):
 1. \<And>x y. \<lbrakk>\<Gamma> x = Some y; tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; x \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
with wf
[PROOF STATE]
proof (chain)
picking this:
tyenv_wellformed mds \<Gamma> \<S> P
v \<notin> mds AsmNoReadOrWrite
[PROOF STEP]
have "v \<notin> snd \<S>"
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
v \<notin> mds AsmNoReadOrWrite

goal (1 subgoal):
 1. v \<notin> snd \<S>
[PROOF STEP]
by(auto simp: tyenv_wellformed_def mds_consistent_def)
[PROOF STATE]
proof (state)
this:
v \<notin> snd \<S>

goal (1 subgoal):
 1. \<And>x y. \<lbrakk>\<Gamma> x = Some y; tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; x \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
show "type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
proof(cases "x \<in> \<C>_vars v")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<in> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
 2. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
assume "x \<in> \<C>_vars v"
[PROOF STATE]
proof (state)
this:
x \<in> \<C>_vars v

goal (2 subgoals):
 1. x \<in> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
 2. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
with assign\<^sub>\<C>(6) \<open>v \<notin> snd \<S>\<close>
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v
v \<notin> snd \<S>
x \<in> \<C>_vars v
[PROOF STEP]
have "(to_total \<Gamma> v) \<le>:\<^sub>P' (dma_type v)"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v
v \<notin> snd \<S>
x \<in> \<C>_vars v

goal (1 subgoal):
 1. to_total \<Gamma> v \<le>:\<^sub>P' dma_type v
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
to_total \<Gamma> v \<le>:\<^sub>P' dma_type v

goal (2 subgoals):
 1. x \<in> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
 2. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
from pred' \<Gamma>v subtype_sound[OF this]
[PROOF STATE]
proof (chain)
picking this:
pred P' mem\<^sub>1'
\<Gamma> v = Some t'
\<forall>mem. pred P' mem \<longrightarrow> type_max (to_total \<Gamma> v) mem \<le> type_max (dma_type v) mem
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
pred P' mem\<^sub>1'
\<Gamma> v = Some t'
\<forall>mem. pred P' mem \<longrightarrow> type_max (to_total \<Gamma> v) mem \<le> type_max (dma_type v) mem

goal (1 subgoal):
 1. type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
using type_max_dma_type
[PROOF STATE]
proof (prove)
using this:
pred P' mem\<^sub>1'
\<Gamma> v = Some t'
\<forall>mem. pred P' mem \<longrightarrow> type_max (to_total \<Gamma> v) mem \<le> type_max (dma_type v) mem
type_max (dma_type ?x) ?mem = dma ?mem ?x

goal (1 subgoal):
 1. type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
by(auto simp: to_total_def split: if_splits)
[PROOF STATE]
proof (state)
this:
type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v

goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
assume "x \<notin> \<C>_vars v"
[PROOF STATE]
proof (state)
this:
x \<notin> \<C>_vars v

goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
hence "\<forall>v'\<in>\<C>_vars v. mem\<^sub>1 v' = mem\<^sub>1' v'"
[PROOF STATE]
proof (prove)
using this:
x \<notin> \<C>_vars v

goal (1 subgoal):
 1. \<forall>v'\<in>\<C>_vars v. mem\<^sub>1 v' = mem\<^sub>1' v'
[PROOF STEP]
using upd
[PROOF STATE]
proof (prove)
using this:
x \<notin> \<C>_vars v
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. \<forall>v'\<in>\<C>_vars v. mem\<^sub>1 v' = mem\<^sub>1' v'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>v'\<in>\<C>_vars v. mem\<^sub>1 v' = mem\<^sub>1' v'

goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
hence dma_eq: "dma mem\<^sub>1 v = dma mem\<^sub>1' v"
[PROOF STATE]
proof (prove)
using this:
\<forall>v'\<in>\<C>_vars v. mem\<^sub>1 v' = mem\<^sub>1' v'

goal (1 subgoal):
 1. dma mem\<^sub>1 v = dma mem\<^sub>1' v
[PROOF STEP]
by(rule dma_\<C>_vars)
[PROOF STATE]
proof (state)
this:
dma mem\<^sub>1 v = dma mem\<^sub>1' v

goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
from \<Gamma>v assign\<^sub>\<C>(4)
[PROOF STATE]
proof (chain)
picking this:
\<Gamma> v = Some t'
\<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v))
[PROOF STEP]
have "x \<notin> vars_of_type t'"
[PROOF STATE]
proof (prove)
using this:
\<Gamma> v = Some t'
\<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v))

goal (1 subgoal):
 1. x \<notin> vars_of_type t'
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
x \<notin> vars_of_type t'

goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
have "type_wellformed t'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. type_wellformed t'
[PROOF STEP]
using wf \<Gamma>v
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
\<Gamma> v = Some t'

goal (1 subgoal):
 1. type_wellformed t'
[PROOF STEP]
by(force simp: tyenv_wellformed_def types_wellformed_def)
[PROOF STATE]
proof (state)
this:
type_wellformed t'

goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
with \<open>x \<notin> vars_of_type t'\<close> upd
[PROOF STATE]
proof (chain)
picking this:
x \<notin> vars_of_type t'
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
type_wellformed t'
[PROOF STEP]
have f_eq: "type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'"
[PROOF STATE]
proof (prove)
using this:
x \<notin> vars_of_type t'
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
type_wellformed t'

goal (1 subgoal):
 1. type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
[PROOF STEP]
using vars_of_type_eq_type_max_eq
[PROOF STATE]
proof (prove)
using this:
x \<notin> vars_of_type t'
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
type_wellformed t'
\<forall>x\<in>vars_of_type ?t. ?mem\<^sub>1 x = ?mem\<^sub>2 x \<Longrightarrow> type_max ?t ?mem\<^sub>1 = type_max ?t ?mem\<^sub>2

goal (1 subgoal):
 1. type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'

goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
from sec \<Gamma>v readable
[PROOF STATE]
proof (chain)
picking this:
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<Gamma> v = Some t'
v \<notin> mds AsmNoReadOrWrite
[PROOF STEP]
have "type_max t' mem\<^sub>1 \<le> dma mem\<^sub>1 v"
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<Gamma> v = Some t'
v \<notin> mds AsmNoReadOrWrite

goal (1 subgoal):
 1. type_max t' mem\<^sub>1 \<le> dma mem\<^sub>1 v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
type_max t' mem\<^sub>1 \<le> dma mem\<^sub>1 v

goal (1 subgoal):
 1. x \<notin> \<C>_vars v \<Longrightarrow> type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
with f_eq dma_eq \<Gamma>v
[PROOF STATE]
proof (chain)
picking this:
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
dma mem\<^sub>1 v = dma mem\<^sub>1' v
\<Gamma> v = Some t'
type_max t' mem\<^sub>1 \<le> dma mem\<^sub>1 v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
dma mem\<^sub>1 v = dma mem\<^sub>1' v
\<Gamma> v = Some t'
type_max t' mem\<^sub>1 \<le> dma mem\<^sub>1 v

goal (1 subgoal):
 1. type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
type_max (the (\<Gamma> v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds' AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds' AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x
[PROOF STEP]
have \<R>':
    "\<langle>Stop, mds', mem\<^sub>1 (x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2 (x := ev\<^sub>A mem\<^sub>2 e)\<rangle>"
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds' AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x

goal (1 subgoal):
 1. \<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e); tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' \<Gamma> \<S> P'; pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'; pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)); tyenv_wellformed mds \<Gamma> \<S> P \<and> pred P mem\<^sub>1 \<and> (\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>. x \<notin> mds' AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1' \<le> dma mem\<^sub>1' x\<rbrakk> \<Longrightarrow> \<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
apply (rule \<R>.intro\<^sub>1, auto simp: assign\<^sub>\<C>)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have a: "\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2 (x := ev\<^sub>A mem\<^sub>2 e)\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
by (auto, metis cxt_to_stmt.simps(1) eval\<^sub>w.unannotated eval\<^sub>w_simple.assign)
[PROOF STATE]
proof (state)
this:
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (6 subgoals):
 1. \<And>x \<Gamma> e t P P' \<S> mds c\<^sub>1'. \<lbrakk>x \<in> \<C>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; P \<turnstile> t; \<forall>v\<in>dom \<Gamma>. x \<notin> vars_of_type (the (\<Gamma> v)); P' = assign_post P x e |` {v. local.stable \<S> v}; \<forall>v. x \<in> \<C>_vars v \<and> v \<notin> snd \<S> \<longrightarrow> P \<turnstile> to_total \<Gamma> v \<and> to_total \<Gamma> v \<le>:\<^sub>P' dma_type v; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 6. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from \<R>' a
[PROOF STATE]
proof (chain)
picking this:
\<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
using \<open>c\<^sub>1' = Stop\<close> and \<open>mem\<^sub>1' = mem\<^sub>1 (x := ev\<^sub>A mem\<^sub>1 e)\<close>
[PROOF STATE]
proof (prove)
using this:
\<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
c\<^sub>1' = Stop
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
(* assign\<^sub>2 *)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
case (assign\<^sub>2 x \<Gamma> e t \<S> P' P mds)
[PROOF STATE]
proof (state)
this:
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have upd [simp]: "c\<^sub>1' = Stop" "mds' = mds" "mem\<^sub>1' = mem\<^sub>1 (x := ev\<^sub>A mem\<^sub>1 e)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c\<^sub>1' = Stop &&& mds' = mds &&& mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
[PROOF STEP]
using assign_elim[OF assign\<^sub>2(11)]
[PROOF STATE]
proof (prove)
using this:
c\<^sub>1' = Stop \<and> mds = mds' \<and> mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. c\<^sub>1' = Stop &&& mds' = mds &&& mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from \<open>x \<in> dom \<Gamma>\<close> \<open>tyenv_wellformed mds \<Gamma> \<S> P\<close>
[PROOF STATE]
proof (chain)
picking this:
x \<in> dom \<Gamma>
tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
have x_nin_\<C>: "x \<notin> \<C>"
[PROOF STATE]
proof (prove)
using this:
x \<in> dom \<Gamma>
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. x \<notin> \<C>
[PROOF STEP]
by(auto simp: tyenv_wellformed_def mds_consistent_def)
[PROOF STATE]
proof (state)
this:
x \<notin> \<C>

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
hence dma_eq [simp]: "dma mem\<^sub>1' = dma mem\<^sub>1"
[PROOF STATE]
proof (prove)
using this:
x \<notin> \<C>

goal (1 subgoal):
 1. dma mem\<^sub>1' = dma mem\<^sub>1
[PROOF STEP]
using dma_\<C> assign\<^sub>2
[PROOF STATE]
proof (prove)
using this:
x \<notin> \<C>
\<forall>x\<in>\<C>. ?mem\<^sub>1 x = ?mem\<^sub>2 x \<Longrightarrow> dma ?mem\<^sub>1 = dma ?mem\<^sub>2
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. dma mem\<^sub>1' = dma mem\<^sub>1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dma mem\<^sub>1' = dma mem\<^sub>1

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
let ?\<Gamma>' = "\<Gamma> (x \<mapsto> t)"
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds, mem\<^sub>2 (x := ev\<^sub>A mem\<^sub>2 e)\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
using assign\<^sub>2
[PROOF STATE]
proof (prove)
using this:
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
by (metis cxt_to_stmt.simps(1) eval\<^sub>w_simplep.assign eval\<^sub>wp.unannotated eval\<^sub>wp_eval\<^sub>w_eq)
[PROOF STATE]
proof (state)
this:
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have tyenv_eq': "mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>(x \<mapsto> t)\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>(x \<mapsto> t)\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)
[PROOF STEP]
unfolding tyenv_eq_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>xa. type_max (to_total (\<Gamma>(x \<mapsto> t)) xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
proof(clarify)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa. type_max (to_total (\<Gamma>(x \<mapsto> t)) xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
fix v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa. type_max (to_total (\<Gamma>(x \<mapsto> t)) xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
assume is_Low': "type_max (to_total (\<Gamma>(x \<mapsto> t)) v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low"
[PROOF STATE]
proof (state)
this:
type_max (to_total (\<Gamma>(x \<mapsto> t)) v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low

goal (1 subgoal):
 1. \<And>xa. type_max (to_total (\<Gamma>(x \<mapsto> t)) xa) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) xa
[PROOF STEP]
show "(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
proof(cases "v = x")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. v = x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<noteq> x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume neq: "v \<noteq> x"
[PROOF STATE]
proof (state)
this:
v \<noteq> x

goal (2 subgoals):
 1. v = x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<noteq> x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
hence "type_max (to_total \<Gamma> v) mem\<^sub>1 = Low"
[PROOF STATE]
proof (prove)
using this:
v \<noteq> x

goal (1 subgoal):
 1. type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
proof(cases "v \<in> dom \<Gamma>")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>v \<noteq> x; v \<in> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
 2. \<lbrakk>v \<noteq> x; v \<notin> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
assume "v \<in> dom \<Gamma>"
[PROOF STATE]
proof (state)
this:
v \<in> dom \<Gamma>

goal (2 subgoals):
 1. \<lbrakk>v \<noteq> x; v \<in> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
 2. \<lbrakk>v \<noteq> x; v \<notin> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
v \<in> dom \<Gamma>
[PROOF STEP]
obtain t' where [simp]: "\<Gamma> v = Some t'"
[PROOF STATE]
proof (prove)
using this:
v \<in> dom \<Gamma>

goal (1 subgoal):
 1. (\<And>t'. \<Gamma> v = Some t' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
\<Gamma> v = Some t'

goal (2 subgoals):
 1. \<lbrakk>v \<noteq> x; v \<in> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
 2. \<lbrakk>v \<noteq> x; v \<notin> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
hence [simp]: "(to_total \<Gamma> v) = t'"
[PROOF STATE]
proof (prove)
using this:
\<Gamma> v = Some t'

goal (1 subgoal):
 1. to_total \<Gamma> v = t'
[PROOF STEP]
unfolding to_total_def
[PROOF STATE]
proof (prove)
using this:
\<Gamma> v = Some t'

goal (1 subgoal):
 1. (if v \<in> dom \<Gamma> then the (\<Gamma> v) else dma_type v) = t'
[PROOF STEP]
by (auto split: if_splits)
[PROOF STATE]
proof (state)
this:
to_total \<Gamma> v = t'

goal (2 subgoals):
 1. \<lbrakk>v \<noteq> x; v \<in> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
 2. \<lbrakk>v \<noteq> x; v \<notin> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
hence [simp]: "(to_total ?\<Gamma>' v) = t'"
[PROOF STATE]
proof (prove)
using this:
to_total \<Gamma> v = t'

goal (1 subgoal):
 1. to_total (\<Gamma>(x \<mapsto> t)) v = t'
[PROOF STEP]
using neq
[PROOF STATE]
proof (prove)
using this:
to_total \<Gamma> v = t'
v \<noteq> x

goal (1 subgoal):
 1. to_total (\<Gamma>(x \<mapsto> t)) v = t'
[PROOF STEP]
by(auto simp: to_total_def)
[PROOF STATE]
proof (state)
this:
to_total (\<Gamma>(x \<mapsto> t)) v = t'

goal (2 subgoals):
 1. \<lbrakk>v \<noteq> x; v \<in> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
 2. \<lbrakk>v \<noteq> x; v \<notin> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
have "type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
[PROOF STEP]
apply(rule \<C>_eq_type_max_eq)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. type_wellformed t'
 2. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
using assign\<^sub>2(6)
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P

goal (2 subgoals):
 1. type_wellformed t'
 2. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
apply(clarsimp simp: tyenv_wellformed_def types_wellformed_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mds_consistent mds \<Gamma> \<S> P; \<forall>x\<in>dom \<Gamma>. type_wellformed (the (\<Gamma> x)); types_stable \<Gamma> \<S>\<rbrakk> \<Longrightarrow> type_wellformed t'
 2. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
using \<open>v \<in> dom \<Gamma>\<close> \<open>\<Gamma> v = Some t'\<close>
[PROOF STATE]
proof (prove)
using this:
v \<in> dom \<Gamma>
\<Gamma> v = Some t'

goal (2 subgoals):
 1. \<lbrakk>mds_consistent mds \<Gamma> \<S> P; \<forall>x\<in>dom \<Gamma>. type_wellformed (the (\<Gamma> x)); types_stable \<Gamma> \<S>\<rbrakk> \<Longrightarrow> type_wellformed t'
 2. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
apply(metis option.sel)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
using x_nin_\<C>
[PROOF STATE]
proof (prove)
using this:
x \<notin> \<C>

goal (1 subgoal):
 1. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'

goal (2 subgoals):
 1. \<lbrakk>v \<noteq> x; v \<in> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
 2. \<lbrakk>v \<noteq> x; v \<notin> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
from this is_Low' neq neq[THEN not_sym]
[PROOF STATE]
proof (chain)
picking this:
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
type_max (to_total (\<Gamma>(x \<mapsto> t)) v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
v \<noteq> x
x \<noteq> v
[PROOF STEP]
show "type_max (to_total \<Gamma> v) mem\<^sub>1 = Low"
[PROOF STATE]
proof (prove)
using this:
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
type_max (to_total (\<Gamma>(x \<mapsto> t)) v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
v \<noteq> x
x \<noteq> v

goal (1 subgoal):
 1. type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low

goal (1 subgoal):
 1. \<lbrakk>v \<noteq> x; v \<notin> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>v \<noteq> x; v \<notin> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
assume "v \<notin> dom \<Gamma>"
[PROOF STATE]
proof (state)
this:
v \<notin> dom \<Gamma>

goal (1 subgoal):
 1. \<lbrakk>v \<noteq> x; v \<notin> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
with is_Low' neq
[PROOF STATE]
proof (chain)
picking this:
type_max (to_total (\<Gamma>(x \<mapsto> t)) v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
v \<noteq> x
v \<notin> dom \<Gamma>
[PROOF STEP]
have "dma mem\<^sub>1' v = Low"
[PROOF STATE]
proof (prove)
using this:
type_max (to_total (\<Gamma>(x \<mapsto> t)) v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
v \<noteq> x
v \<notin> dom \<Gamma>

goal (1 subgoal):
 1. dma mem\<^sub>1' v = Low
[PROOF STEP]
by(auto simp: to_total_def  split: if_splits)
[PROOF STATE]
proof (state)
this:
dma mem\<^sub>1' v = Low

goal (1 subgoal):
 1. \<lbrakk>v \<noteq> x; v \<notin> dom \<Gamma>\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
with dma_eq \<open>v \<notin> dom \<Gamma>\<close>
[PROOF STATE]
proof (chain)
picking this:
dma mem\<^sub>1' = dma mem\<^sub>1
v \<notin> dom \<Gamma>
dma mem\<^sub>1' v = Low
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
dma mem\<^sub>1' = dma mem\<^sub>1
v \<notin> dom \<Gamma>
dma mem\<^sub>1' v = Low

goal (1 subgoal):
 1. type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
by(auto simp: to_total_def  split: if_splits)
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low

goal (2 subgoals):
 1. v = x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
 2. v \<noteq> x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with neq assign\<^sub>2(7)
[PROOF STATE]
proof (chain)
picking this:
v \<noteq> x
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low
[PROOF STEP]
show "(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v"
[PROOF STATE]
proof (prove)
using this:
v \<noteq> x
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
type_max (to_total \<Gamma> v) mem\<^sub>1 = Low

goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
by(auto simp: tyenv_eq_def)
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal (1 subgoal):
 1. v = x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. v = x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
assume eq[simp]: "v = x"
[PROOF STATE]
proof (state)
this:
v = x

goal (1 subgoal):
 1. v = x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with is_Low' \<open>x \<in> dom \<Gamma>\<close>
[PROOF STATE]
proof (chain)
picking this:
type_max (to_total (\<Gamma>(x \<mapsto> t)) v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
x \<in> dom \<Gamma>
v = x
[PROOF STEP]
have t_Low': "type_max t mem\<^sub>1' = Low"
[PROOF STATE]
proof (prove)
using this:
type_max (to_total (\<Gamma>(x \<mapsto> t)) v) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) = Low
x \<in> dom \<Gamma>
v = x

goal (1 subgoal):
 1. type_max t mem\<^sub>1' = Low
[PROOF STEP]
by(auto simp: to_total_def split: if_splits)
[PROOF STATE]
proof (state)
this:
type_max t mem\<^sub>1' = Low

goal (1 subgoal):
 1. v = x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
have wf_t: "type_wellformed t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. type_wellformed t
[PROOF STEP]
using type_aexpr_type_wellformed assign\<^sub>2(2) assign\<^sub>2(6)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>types_wellformed ?\<Gamma>; ?\<Gamma> \<turnstile>\<^sub>a ?e \<in> ?t\<rbrakk> \<Longrightarrow> type_wellformed ?t
\<Gamma> \<turnstile>\<^sub>a e \<in> t
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. type_wellformed t
[PROOF STEP]
by(fastforce simp: tyenv_wellformed_def)
[PROOF STATE]
proof (state)
this:
type_wellformed t

goal (1 subgoal):
 1. v = x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
with t_Low' \<open>x \<notin> \<C>\<close>
[PROOF STATE]
proof (chain)
picking this:
type_max t mem\<^sub>1' = Low
x \<notin> \<C>
type_wellformed t
[PROOF STEP]
have t_Low: "type_max t mem\<^sub>1 = Low"
[PROOF STATE]
proof (prove)
using this:
type_max t mem\<^sub>1' = Low
x \<notin> \<C>
type_wellformed t

goal (1 subgoal):
 1. type_max t mem\<^sub>1 = Low
[PROOF STEP]
using \<C>_eq_type_max_eq
[PROOF STATE]
proof (prove)
using this:
type_max t mem\<^sub>1' = Low
x \<notin> \<C>
type_wellformed t
\<lbrakk>type_wellformed ?t; \<forall>x\<in>\<C>. ?mem\<^sub>1 x = ?mem\<^sub>2 x\<rbrakk> \<Longrightarrow> type_max ?t ?mem\<^sub>1 = type_max ?t ?mem\<^sub>2

goal (1 subgoal):
 1. type_max t mem\<^sub>1 = Low
[PROOF STEP]
by (metis (no_types, lifting) fun_upd_other upd(3))
[PROOF STATE]
proof (state)
this:
type_max t mem\<^sub>1 = Low

goal (1 subgoal):
 1. v = x \<Longrightarrow> (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v
[PROOF STEP]
proof(simp, rule eval_vars_det\<^sub>A, clarify)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> aexp_vars e \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x
[PROOF STEP]
fix y
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> aexp_vars e \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x
[PROOF STEP]
assume in_vars: "y \<in> aexp_vars e"
[PROOF STATE]
proof (state)
this:
y \<in> aexp_vars e

goal (1 subgoal):
 1. \<And>x. x \<in> aexp_vars e \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x
[PROOF STEP]
have "type_max (to_total \<Gamma> y) mem\<^sub>1 = Low"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. type_max (to_total \<Gamma> y) mem\<^sub>1 = Low
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. type_max (to_total \<Gamma> y) mem\<^sub>1 = Low
[PROOF STEP]
from t_Low in_vars assign\<^sub>2(2)
[PROOF STATE]
proof (chain)
picking this:
type_max t mem\<^sub>1 = Low
y \<in> aexp_vars e
\<Gamma> \<turnstile>\<^sub>a e \<in> t
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
type_max t mem\<^sub>1 = Low
y \<in> aexp_vars e
\<Gamma> \<turnstile>\<^sub>a e \<in> t

goal (1 subgoal):
 1. type_max (to_total \<Gamma> y) mem\<^sub>1 = Low
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>type_max t mem\<^sub>1 = Low; y \<in> aexp_vars e; \<Gamma> \<turnstile>\<^sub>a e \<in> t\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> y) mem\<^sub>1 = Low
[PROOF STEP]
apply(erule type_aexpr.cases)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<Gamma> ea. \<lbrakk>type_max t mem\<^sub>1 = Low; y \<in> aexp_vars e; \<Gamma> = \<Gamma>; e = ea; t = \<Union> (to_total \<Gamma> ` aexp_vars ea)\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> y) mem\<^sub>1 = Low
[PROOF STEP]
using Sec.exhaust
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?y = High \<Longrightarrow> ?P; ?y = Low \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P

goal (1 subgoal):
 1. \<And>\<Gamma> ea. \<lbrakk>type_max t mem\<^sub>1 = Low; y \<in> aexp_vars e; \<Gamma> = \<Gamma>; e = ea; t = \<Union> (to_total \<Gamma> ` aexp_vars ea)\<rbrakk> \<Longrightarrow> type_max (to_total \<Gamma> y) mem\<^sub>1 = Low
[PROOF STEP]
by(auto simp: type_max_def  split: if_splits)
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> y) mem\<^sub>1 = Low

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
type_max (to_total \<Gamma> y) mem\<^sub>1 = Low

goal (1 subgoal):
 1. \<And>x. x \<in> aexp_vars e \<Longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x
[PROOF STEP]
thus "mem\<^sub>1 y = mem\<^sub>2 y"
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> y) mem\<^sub>1 = Low

goal (1 subgoal):
 1. mem\<^sub>1 y = mem\<^sub>2 y
[PROOF STEP]
using assign\<^sub>2
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> y) mem\<^sub>1 = Low
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. mem\<^sub>1 y = mem\<^sub>2 y
[PROOF STEP]
unfolding tyenv_eq_def
[PROOF STATE]
proof (prove)
using this:
type_max (to_total \<Gamma> y) mem\<^sub>1 = Low
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
\<forall>x. type_max (to_total \<Gamma> x) mem\<^sub>1 = Low \<longrightarrow> mem\<^sub>1 x = mem\<^sub>2 x
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. mem\<^sub>1 y = mem\<^sub>2 y
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 y = mem\<^sub>2 y

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) v = (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)) v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>(x \<mapsto> t)\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from upd
[PROOF STATE]
proof (chain)
picking this:
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
[PROOF STEP]
have ty: " \<turnstile> ?\<Gamma>',\<S>,P' {c\<^sub>1'} ?\<Gamma>',\<S>,P'"
[PROOF STATE]
proof (prove)
using this:
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. \<turnstile> \<Gamma>(x \<mapsto> t),\<S>,P' {c\<^sub>1'} \<Gamma>(x \<mapsto> t),\<S>,P'
[PROOF STEP]
by (metis stop_type)
[PROOF STATE]
proof (state)
this:
\<turnstile> \<Gamma>(x \<mapsto> t),\<S>,P' {c\<^sub>1'} \<Gamma>(x \<mapsto> t),\<S>,P'

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have wf: "tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' ?\<Gamma>' \<S> P'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<Longrightarrow> tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
assume tyenv_wf: "tyenv_wellformed mds \<Gamma> \<S> P"
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<Longrightarrow> tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
hence wf: "types_wellformed \<Gamma>"
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. types_wellformed \<Gamma>
[PROOF STEP]
unfolding tyenv_wellformed_def
[PROOF STATE]
proof (prove)
using this:
mds_consistent mds \<Gamma> \<S> P \<and> types_wellformed \<Gamma> \<and> types_stable \<Gamma> \<S>

goal (1 subgoal):
 1. types_wellformed \<Gamma>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
types_wellformed \<Gamma>

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<Longrightarrow> tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
hence  "type_wellformed t"
[PROOF STATE]
proof (prove)
using this:
types_wellformed \<Gamma>

goal (1 subgoal):
 1. type_wellformed t
[PROOF STEP]
using assign\<^sub>2(2) type_aexpr_type_wellformed
[PROOF STATE]
proof (prove)
using this:
types_wellformed \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
\<lbrakk>types_wellformed ?\<Gamma>; ?\<Gamma> \<turnstile>\<^sub>a ?e \<in> ?t\<rbrakk> \<Longrightarrow> type_wellformed ?t

goal (1 subgoal):
 1. type_wellformed t
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
type_wellformed t

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<Longrightarrow> tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
with wf
[PROOF STATE]
proof (chain)
picking this:
types_wellformed \<Gamma>
type_wellformed t
[PROOF STEP]
have wf': "types_wellformed ?\<Gamma>'"
[PROOF STATE]
proof (prove)
using this:
types_wellformed \<Gamma>
type_wellformed t

goal (1 subgoal):
 1. types_wellformed (\<Gamma>(x \<mapsto> t))
[PROOF STEP]
using types_wellformed_update
[PROOF STATE]
proof (prove)
using this:
types_wellformed \<Gamma>
type_wellformed t
\<lbrakk>types_wellformed ?\<Gamma>; type_wellformed ?t\<rbrakk> \<Longrightarrow> types_wellformed (?\<Gamma>(?x \<mapsto> ?t))

goal (1 subgoal):
 1. types_wellformed (\<Gamma>(x \<mapsto> t))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
types_wellformed (\<Gamma>(x \<mapsto> t))

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<Longrightarrow> tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
from tyenv_wf
[PROOF STATE]
proof (chain)
picking this:
tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
have stable': "types_stable ?\<Gamma>' \<S>"
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. types_stable (\<Gamma>(x \<mapsto> t)) \<S>
[PROOF STEP]
using types_stable_update
            assign\<^sub>2(3)
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
\<lbrakk>types_stable ?\<Gamma> ?\<S>; type_stable ?\<S> ?t\<rbrakk> \<Longrightarrow> types_stable (?\<Gamma>(?x \<mapsto> ?t)) ?\<S>
type_stable \<S> t

goal (1 subgoal):
 1. types_stable (\<Gamma>(x \<mapsto> t)) \<S>
[PROOF STEP]
unfolding tyenv_wellformed_def
[PROOF STATE]
proof (prove)
using this:
mds_consistent mds \<Gamma> \<S> P \<and> types_wellformed \<Gamma> \<and> types_stable \<Gamma> \<S>
\<lbrakk>types_stable ?\<Gamma> ?\<S>; type_stable ?\<S> ?t\<rbrakk> \<Longrightarrow> types_stable (?\<Gamma>(?x \<mapsto> ?t)) ?\<S>
type_stable \<S> t

goal (1 subgoal):
 1. types_stable (\<Gamma>(x \<mapsto> t)) \<S>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
types_stable (\<Gamma>(x \<mapsto> t)) \<S>

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<Longrightarrow> tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
have m: "mds_consistent mds \<Gamma> \<S> P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mds_consistent mds \<Gamma> \<S> P
[PROOF STEP]
using tyenv_wf
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. mds_consistent mds \<Gamma> \<S> P
[PROOF STEP]
unfolding tyenv_wellformed_def
[PROOF STATE]
proof (prove)
using this:
mds_consistent mds \<Gamma> \<S> P \<and> types_wellformed \<Gamma> \<and> types_stable \<Gamma> \<S>

goal (1 subgoal):
 1. mds_consistent mds \<Gamma> \<S> P
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
mds_consistent mds \<Gamma> \<S> P

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<Longrightarrow> tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
from assign\<^sub>2(4) assign\<^sub>2(1)
[PROOF STATE]
proof (chain)
picking this:
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<in> dom \<Gamma>
[PROOF STEP]
have "mds_consistent mds' (\<Gamma>(x \<mapsto> t)) \<S> P'"
[PROOF STATE]
proof (prove)
using this:
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<in> dom \<Gamma>

goal (1 subgoal):
 1. mds_consistent mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
apply(rule mds_consistent_preds_tyenv_update)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mds_consistent mds' \<Gamma> \<S> ?P
[PROOF STEP]
using upd m
[PROOF STATE]
proof (prove)
using this:
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
mds_consistent mds \<Gamma> \<S> P

goal (1 subgoal):
 1. mds_consistent mds' \<Gamma> \<S> ?P
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
mds_consistent mds' (\<Gamma>(x \<mapsto> t)) \<S> P'

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P \<Longrightarrow> tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
from wf' stable' this
[PROOF STATE]
proof (chain)
picking this:
types_wellformed (\<Gamma>(x \<mapsto> t))
types_stable (\<Gamma>(x \<mapsto> t)) \<S>
mds_consistent mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
show "tyenv_wellformed mds' ?\<Gamma>' \<S> P'"
[PROOF STATE]
proof (prove)
using this:
types_wellformed (\<Gamma>(x \<mapsto> t))
types_stable (\<Gamma>(x \<mapsto> t)) \<S>
mds_consistent mds' (\<Gamma>(x \<mapsto> t)) \<S> P'

goal (1 subgoal):
 1. tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
[PROOF STEP]
unfolding tyenv_wellformed_def
[PROOF STATE]
proof (prove)
using this:
types_wellformed (\<Gamma>(x \<mapsto> t))
types_stable (\<Gamma>(x \<mapsto> t)) \<S>
mds_consistent mds' (\<Gamma>(x \<mapsto> t)) \<S> P'

goal (1 subgoal):
 1. mds_consistent mds' (\<Gamma>(x \<mapsto> t)) \<S> P' \<and> types_wellformed (\<Gamma>(x \<mapsto> t)) \<and> types_stable (\<Gamma>(x \<mapsto> t)) \<S>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have p: "pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
[PROOF STEP]
using pred_preds_update assign\<^sub>2 upd
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?mem' = ?mem(?x := ev\<^sub>A ?mem ?e); ?P' = assign_post ?P ?x ?e |` {v. local.stable ?\<S> v}; pred ?P ?mem\<rbrakk> \<Longrightarrow> pred ?P' ?mem'
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have p\<^sub>2: "pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
[PROOF STEP]
using pred_preds_update assign\<^sub>2 upd
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?mem' = ?mem(?x := ev\<^sub>A ?mem ?e); ?P' = assign_post ?P ?x ?e |` {v. local.stable ?\<S> v}; pred ?P ?mem\<rbrakk> \<Longrightarrow> pred ?P' ?mem'
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have sec: "tyenv_wellformed mds \<Gamma> \<S> P \<Longrightarrow> pred P mem\<^sub>1 \<Longrightarrow> tyenv_sec mds \<Gamma> mem\<^sub>1 \<Longrightarrow> tyenv_sec mds' ?\<Gamma>' mem\<^sub>1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x\<rbrakk> \<Longrightarrow> \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds' AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa
[PROOF STEP]
proof(clarify)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa y. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; (\<Gamma>(x \<mapsto> t)) xa = Some y; xa \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa
[PROOF STEP]
assume wf: "tyenv_wellformed mds \<Gamma> \<S> P"
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. \<And>xa y. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; (\<Gamma>(x \<mapsto> t)) xa = Some y; xa \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa
[PROOF STEP]
assume pred: "pred P mem\<^sub>1"
[PROOF STATE]
proof (state)
this:
pred P mem\<^sub>1

goal (1 subgoal):
 1. \<And>xa y. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; (\<Gamma>(x \<mapsto> t)) xa = Some y; xa \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa
[PROOF STEP]
assume sec: "tyenv_sec mds \<Gamma> mem\<^sub>1"
[PROOF STATE]
proof (state)
this:
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x

goal (1 subgoal):
 1. \<And>xa y. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; (\<Gamma>(x \<mapsto> t)) xa = Some y; xa \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa
[PROOF STEP]
from pred p
[PROOF STATE]
proof (chain)
picking this:
pred P mem\<^sub>1
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
[PROOF STEP]
have pred': "pred P' mem\<^sub>1'"
[PROOF STATE]
proof (prove)
using this:
pred P mem\<^sub>1
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'

goal (1 subgoal):
 1. pred P' mem\<^sub>1'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
pred P' mem\<^sub>1'

goal (1 subgoal):
 1. \<And>xa y. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; (\<Gamma>(x \<mapsto> t)) xa = Some y; xa \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa
[PROOF STEP]
fix v t'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa y. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; (\<Gamma>(x \<mapsto> t)) xa = Some y; xa \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa
[PROOF STEP]
assume \<Gamma>v: "(\<Gamma>(x \<mapsto> t)) v = Some t'"
[PROOF STATE]
proof (state)
this:
(\<Gamma>(x \<mapsto> t)) v = Some t'

goal (1 subgoal):
 1. \<And>xa y. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; (\<Gamma>(x \<mapsto> t)) xa = Some y; xa \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa
[PROOF STEP]
assume "v \<notin> mds' AsmNoReadOrWrite"
[PROOF STATE]
proof (state)
this:
v \<notin> mds' AsmNoReadOrWrite

goal (1 subgoal):
 1. \<And>xa y. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; (\<Gamma>(x \<mapsto> t)) xa = Some y; xa \<notin> mds' AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa
[PROOF STEP]
show "type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
proof(cases "v = x")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. v = x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
 2. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
assume [simp]: "v = x"
[PROOF STATE]
proof (state)
this:
v = x

goal (2 subgoals):
 1. v = x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
 2. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
hence [simp]: "(the ((\<Gamma>(x \<mapsto> t)) v)) = t" and t_def: "t = t'"
[PROOF STATE]
proof (prove)
using this:
v = x

goal (1 subgoal):
 1. the ((\<Gamma>(x \<mapsto> t)) v) = t &&& t = t'
[PROOF STEP]
using \<Gamma>v
[PROOF STATE]
proof (prove)
using this:
v = x
(\<Gamma>(x \<mapsto> t)) v = Some t'

goal (1 subgoal):
 1. the ((\<Gamma>(x \<mapsto> t)) v) = t &&& t = t'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
the ((\<Gamma>(x \<mapsto> t)) v) = t
t = t'

goal (2 subgoals):
 1. v = x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
 2. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
from \<open>v \<notin> mds' AsmNoReadOrWrite\<close> upd wf
[PROOF STATE]
proof (chain)
picking this:
v \<notin> mds' AsmNoReadOrWrite
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
have readable: "v \<notin> snd \<S>"
[PROOF STATE]
proof (prove)
using this:
v \<notin> mds' AsmNoReadOrWrite
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. v \<notin> snd \<S>
[PROOF STEP]
by(auto simp: tyenv_wellformed_def mds_consistent_def)
[PROOF STATE]
proof (state)
this:
v \<notin> snd \<S>

goal (2 subgoals):
 1. v = x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
 2. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
with assign\<^sub>2(5)
[PROOF STATE]
proof (chain)
picking this:
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
v \<notin> snd \<S>
[PROOF STEP]
have "t \<le>:\<^sub>P' (dma_type x)"
[PROOF STATE]
proof (prove)
using this:
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
v \<notin> snd \<S>

goal (1 subgoal):
 1. t \<le>:\<^sub>P' dma_type x
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
t \<le>:\<^sub>P' dma_type x

goal (2 subgoals):
 1. v = x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
 2. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
with pred'
[PROOF STATE]
proof (chain)
picking this:
pred P' mem\<^sub>1'
t \<le>:\<^sub>P' dma_type x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
pred P' mem\<^sub>1'
t \<le>:\<^sub>P' dma_type x

goal (1 subgoal):
 1. type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
using type_max_dma_type subtype_sound
[PROOF STATE]
proof (prove)
using this:
pred P' mem\<^sub>1'
t \<le>:\<^sub>P' dma_type x
type_max (dma_type ?x) ?mem = dma ?mem ?x
?t \<le>:\<^sub>?P ?t' \<Longrightarrow> \<forall>mem. pred ?P mem \<longrightarrow> type_max ?t mem \<le> type_max ?t' mem

goal (1 subgoal):
 1. type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v

goal (1 subgoal):
 1. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
assume neq: "v \<noteq> x"
[PROOF STATE]
proof (state)
this:
v \<noteq> x

goal (1 subgoal):
 1. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
hence [simp]: "((\<Gamma>(x \<mapsto> t)) v) = \<Gamma> v"
[PROOF STATE]
proof (prove)
using this:
v \<noteq> x

goal (1 subgoal):
 1. (\<Gamma>(x \<mapsto> t)) v = \<Gamma> v
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<Gamma>(x \<mapsto> t)) v = \<Gamma> v

goal (1 subgoal):
 1. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
with \<Gamma>v
[PROOF STATE]
proof (chain)
picking this:
(\<Gamma>(x \<mapsto> t)) v = Some t'
(\<Gamma>(x \<mapsto> t)) v = \<Gamma> v
[PROOF STEP]
have \<Gamma>v: "\<Gamma> v = Some t'"
[PROOF STATE]
proof (prove)
using this:
(\<Gamma>(x \<mapsto> t)) v = Some t'
(\<Gamma>(x \<mapsto> t)) v = \<Gamma> v

goal (1 subgoal):
 1. \<Gamma> v = Some t'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Gamma> v = Some t'

goal (1 subgoal):
 1. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
with sec upd \<open>v \<notin> mds' AsmNoReadOrWrite\<close>
[PROOF STATE]
proof (chain)
picking this:
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
v \<notin> mds' AsmNoReadOrWrite
\<Gamma> v = Some t'
[PROOF STEP]
have f_leq: "type_max t' mem\<^sub>1 \<le> dma mem\<^sub>1 v"
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)
v \<notin> mds' AsmNoReadOrWrite
\<Gamma> v = Some t'

goal (1 subgoal):
 1. type_max t' mem\<^sub>1 \<le> dma mem\<^sub>1 v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
type_max t' mem\<^sub>1 \<le> dma mem\<^sub>1 v

goal (1 subgoal):
 1. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
have \<C>_eq: "\<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
using wf assign\<^sub>2(1) upd
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
x \<in> dom \<Gamma>
c\<^sub>1' = Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
by(auto simp: tyenv_wellformed_def mds_consistent_def)
[PROOF STATE]
proof (state)
this:
\<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x

goal (1 subgoal):
 1. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
hence dma_eq: "dma mem\<^sub>1 = dma mem\<^sub>1'"
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x

goal (1 subgoal):
 1. dma mem\<^sub>1 = dma mem\<^sub>1'
[PROOF STEP]
by(rule dma_\<C>)
[PROOF STATE]
proof (state)
this:
dma mem\<^sub>1 = dma mem\<^sub>1'

goal (1 subgoal):
 1. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
have f_eq: "type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
[PROOF STEP]
apply(rule \<C>_eq_type_max_eq)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. type_wellformed t'
 2. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
using \<Gamma>v wf
[PROOF STATE]
proof (prove)
using this:
\<Gamma> v = Some t'
tyenv_wellformed mds \<Gamma> \<S> P

goal (2 subgoals):
 1. type_wellformed t'
 2. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
apply(force simp: tyenv_wellformed_def types_wellformed_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>\<C>. mem\<^sub>1 x = mem\<^sub>1' x
[PROOF STEP]
by(rule \<C>_eq)
[PROOF STATE]
proof (state)
this:
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'

goal (1 subgoal):
 1. v \<noteq> x \<Longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
from neq \<Gamma>v f_leq dma_eq f_eq
[PROOF STATE]
proof (chain)
picking this:
v \<noteq> x
\<Gamma> v = Some t'
type_max t' mem\<^sub>1 \<le> dma mem\<^sub>1 v
dma mem\<^sub>1 = dma mem\<^sub>1'
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
v \<noteq> x
\<Gamma> v = Some t'
type_max t' mem\<^sub>1 \<le> dma mem\<^sub>1 v
dma mem\<^sub>1 = dma mem\<^sub>1'
type_max t' mem\<^sub>1 = type_max t' mem\<^sub>1'

goal (1 subgoal):
 1. type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
type_max (the ((\<Gamma>(x \<mapsto> t)) v)) mem\<^sub>1' \<le> dma mem\<^sub>1' v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x\<rbrakk> \<Longrightarrow> \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds' AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "\<langle>Stop, mds, mem\<^sub>1 (x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>1\<^bsub>?\<Gamma>',\<S>,P'\<^esub> \<langle>Stop, mds, mem\<^sub>2 (x := ev\<^sub>A mem\<^sub>2 e)\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>Stop, mds, mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
apply(rule \<R>\<^sub>1.intro)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<turnstile> ?\<Gamma>,?\<S>,?P {Stop} \<Gamma>(x \<mapsto> t),\<S>,P'
 2. tyenv_wellformed mds ?\<Gamma> ?\<S> ?P
 3. mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>?\<Gamma>\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)
 4. pred ?P (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e))
 5. pred ?P (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
 6. \<forall>xa\<in>dom ?\<Gamma>. xa \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (?\<Gamma> xa)) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) \<le> dma (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. tyenv_wellformed mds (\<Gamma>(x \<mapsto> t)) \<S> P'
 2. mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>(x \<mapsto> t)\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)
 3. pred P' (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e))
 4. pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
 5. \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) \<le> dma (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa
[PROOF STEP]
using wf assign\<^sub>2
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds' (\<Gamma>(x \<mapsto> t)) \<S> P'
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (5 subgoals):
 1. tyenv_wellformed mds (\<Gamma>(x \<mapsto> t)) \<S> P'
 2. mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>(x \<mapsto> t)\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)
 3. pred P' (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e))
 4. pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
 5. \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) \<le> dma (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e) =\<^bsub>\<Gamma>(x \<mapsto> t)\<^esub> mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)
 2. pred P' (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e))
 3. pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
 4. \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) \<le> dma (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa
[PROOF STEP]
apply(rule tyenv_eq')
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. pred P' (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e))
 2. pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
 3. \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) \<le> dma (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa
[PROOF STEP]
using p assign\<^sub>2
[PROOF STATE]
proof (prove)
using this:
pred P mem\<^sub>1 \<longrightarrow> pred P' mem\<^sub>1'
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (3 subgoals):
 1. pred P' (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e))
 2. pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
 3. \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) \<le> dma (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
 2. \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) \<le> dma (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa
[PROOF STEP]
using p\<^sub>2 assign\<^sub>2
[PROOF STATE]
proof (prove)
using this:
pred P mem\<^sub>2 \<longrightarrow> pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (2 subgoals):
 1. pred P' (mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e))
 2. \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) \<le> dma (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) \<le> dma (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa
[PROOF STEP]
using sec assign\<^sub>2
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x\<rbrakk> \<Longrightarrow> \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds' AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) \<le> dma (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa
[PROOF STEP]
using upd(2) upd(3)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; pred P mem\<^sub>1; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x\<rbrakk> \<Longrightarrow> \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds' AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) mem\<^sub>1' \<le> dma mem\<^sub>1' xa
x \<in> dom \<Gamma>
\<Gamma> \<turnstile>\<^sub>a e \<in> t
type_stable \<S> t
P' = assign_post P x e |` {v. local.stable \<S> v}
x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
mds' = mds
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. \<forall>xa\<in>dom (\<Gamma>(x \<mapsto> t)). xa \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the ((\<Gamma>(x \<mapsto> t)) xa)) (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) \<le> dma (mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)) xa
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<langle>Stop, mds, mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>Stop, mds, mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
have "\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2 (x := ev\<^sub>A mem\<^sub>2 e)\<rangle>"
    "\<langle>Stop, mds', mem\<^sub>1 (x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2 (x := ev\<^sub>A mem\<^sub>2 e)\<rangle>"
[PROOF STATE]
proof (prove)
using this:
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>Stop, mds, mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (1 subgoal):
 1. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle> &&& \<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
using \<R>.intro\<^sub>1
[PROOF STATE]
proof (prove)
using this:
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>Stop, mds, mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>Stop, mds, mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
(case ?lc of (x, xa) \<Rightarrow> (case x of (x, xa) \<Rightarrow> \<lambda>xb ((xc, xd), xe). \<langle>x, xa, xb\<rangle> \<R>\<^sup>1\<^bsub>?\<Gamma>,?\<S>,?P\<^esub> \<langle>xc, xd, xe\<rangle>) xa) ?lc' \<Longrightarrow> ?lc \<R>\<^sup>u\<^bsub>?\<Gamma>,?\<S>,?P\<^esub> ?lc'

goal (1 subgoal):
 1. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle> &&& \<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (5 subgoals):
 1. \<And>x \<Gamma> e t \<S> P' P mds c\<^sub>1'. \<lbrakk>x \<in> dom \<Gamma>; \<Gamma> \<turnstile>\<^sub>a e \<in> t; type_stable \<S> t; P' = assign_post P x e |` {v. local.stable \<S> v}; x \<notin> snd \<S> \<longrightarrow> t \<le>:\<^sub>P' dma_type x; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>x \<leftarrow> e, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 5. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
using \<open>mds' = mds\<close> \<open>c\<^sub>1' = Stop\<close> \<open>mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<close>
[PROOF STATE]
proof (prove)
using this:
\<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
\<langle>Stop, mds', mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>Stop, mds', mem\<^sub>2(x := ev\<^sub>A mem\<^sub>2 e)\<rangle>
mds' = mds
c\<^sub>1' = Stop
mem\<^sub>1' = mem\<^sub>1(x := ev\<^sub>A mem\<^sub>1 e)

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>x \<leftarrow> e, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>(x \<mapsto> t),\<S>,P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (4 subgoals):
 1. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
(* if *)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
case (if_type \<Gamma> e t P \<S> th \<Gamma>' \<S>' P' el \<Gamma>'' P'' \<Gamma>''' P''')
[PROOF STATE]
proof (state)
this:
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {th} \<Gamma>',\<S>',P'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>th, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>th, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {el} \<Gamma>'',\<S>',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>el, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>el, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<Gamma>' =:\<^sub>P' \<Gamma>'''
\<Gamma>'' =:\<^sub>P'' \<Gamma>'''
P' \<turnstile> P'''
P'' \<turnstile> P'''
\<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''
\<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Stmt.If e th el, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (4 subgoals):
 1. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
let ?P = "if (ev\<^sub>B mem\<^sub>1 e) then P +\<^sub>\<S> e else P +\<^sub>\<S> (bexp_neg e)"
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from \<open>\<langle>Stmt.If e th el, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<close>
[PROOF STATE]
proof (chain)
picking this:
\<langle>Stmt.If e th el, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
[PROOF STEP]
have ty: "\<turnstile> \<Gamma>,\<S>,?P {c\<^sub>1'} \<Gamma>''',\<S>',P'''"
[PROOF STATE]
proof (prove)
using this:
\<langle>Stmt.If e th el, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. \<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''
[PROOF STEP]
proof (rule if_elim)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''
 2. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''
[PROOF STEP]
assume "c\<^sub>1' = th" "mem\<^sub>1' = mem\<^sub>1" "mds' = mds" "ev\<^sub>B mem\<^sub>1 e"
[PROOF STATE]
proof (state)
this:
c\<^sub>1' = th
mem\<^sub>1' = mem\<^sub>1
mds' = mds
ev\<^sub>B mem\<^sub>1 e

goal (2 subgoals):
 1. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''
 2. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''
[PROOF STEP]
with if_type(3)
[PROOF STATE]
proof (chain)
picking this:
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {th} \<Gamma>',\<S>',P'
c\<^sub>1' = th
mem\<^sub>1' = mem\<^sub>1
mds' = mds
ev\<^sub>B mem\<^sub>1 e
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {th} \<Gamma>',\<S>',P'
c\<^sub>1' = th
mem\<^sub>1' = mem\<^sub>1
mds' = mds
ev\<^sub>B mem\<^sub>1 e

goal (1 subgoal):
 1. \<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {th} \<Gamma>',\<S>',P'; c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {th} \<Gamma>''',\<S>',P'''
[PROOF STEP]
apply(erule sub)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<Gamma> =:\<^sub>P +\<^sub>\<S> e \<Gamma>
 2. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e
 3. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''
 4. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<Gamma>' =:\<^sub>P' \<Gamma>'''
 5. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> P +\<^sub>\<S> e \<turnstile> P +\<^sub>\<S> e
 6. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> P' \<turnstile> P'''
[PROOF STEP]
using if_type
[PROOF STATE]
proof (prove)
using this:
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {th} \<Gamma>',\<S>',P'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>th, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>th, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {el} \<Gamma>'',\<S>',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>el, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>el, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<Gamma>' =:\<^sub>P' \<Gamma>'''
\<Gamma>'' =:\<^sub>P'' \<Gamma>'''
P' \<turnstile> P'''
P'' \<turnstile> P'''
\<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''
\<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Stmt.If e th el, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (6 subgoals):
 1. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<Gamma> =:\<^sub>P +\<^sub>\<S> e \<Gamma>
 2. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e
 3. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''
 4. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<Gamma>' =:\<^sub>P' \<Gamma>'''
 5. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> P +\<^sub>\<S> e \<turnstile> P +\<^sub>\<S> e
 6. \<lbrakk>c\<^sub>1' = th; mem\<^sub>1' = mem\<^sub>1; mds' = mds; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> P' \<turnstile> P'''
[PROOF STEP]
apply simp+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''

goal (1 subgoal):
 1. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''
[PROOF STEP]
assume "c\<^sub>1' = el" "mem\<^sub>1' = mem\<^sub>1" "mds' = mds" "\<not> ev\<^sub>B mem\<^sub>1 e"
[PROOF STATE]
proof (state)
this:
c\<^sub>1' = el
mem\<^sub>1' = mem\<^sub>1
mds' = mds
\<not> ev\<^sub>B mem\<^sub>1 e

goal (1 subgoal):
 1. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''
[PROOF STEP]
with if_type(5)
[PROOF STATE]
proof (chain)
picking this:
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {el} \<Gamma>'',\<S>',P''
c\<^sub>1' = el
mem\<^sub>1' = mem\<^sub>1
mds' = mds
\<not> ev\<^sub>B mem\<^sub>1 e
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {el} \<Gamma>'',\<S>',P''
c\<^sub>1' = el
mem\<^sub>1' = mem\<^sub>1
mds' = mds
\<not> ev\<^sub>B mem\<^sub>1 e

goal (1 subgoal):
 1. \<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {el} \<Gamma>'',\<S>',P''; c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {el} \<Gamma>''',\<S>',P'''
[PROOF STEP]
apply(erule sub)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<Gamma> =:\<^sub>P +\<^sub>\<S> bexp_neg e \<Gamma>
 2. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e
 3. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''
 4. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<Gamma>'' =:\<^sub>P'' \<Gamma>'''
 5. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> P +\<^sub>\<S> bexp_neg e \<turnstile> P +\<^sub>\<S> bexp_neg e
 6. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> P'' \<turnstile> P'''
[PROOF STEP]
using if_type
[PROOF STATE]
proof (prove)
using this:
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {th} \<Gamma>',\<S>',P'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>th, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>th, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {el} \<Gamma>'',\<S>',P''
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>el, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>el, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<Gamma>' =:\<^sub>P' \<Gamma>'''
\<Gamma>'' =:\<^sub>P'' \<Gamma>'''
P' \<turnstile> P'''
P'' \<turnstile> P'''
\<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''
\<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Stmt.If e th el, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (6 subgoals):
 1. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<Gamma> =:\<^sub>P +\<^sub>\<S> bexp_neg e \<Gamma>
 2. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e
 3. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''
 4. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<Gamma>'' =:\<^sub>P'' \<Gamma>'''
 5. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> P +\<^sub>\<S> bexp_neg e \<turnstile> P +\<^sub>\<S> bexp_neg e
 6. \<lbrakk>c\<^sub>1' = el; mem\<^sub>1' = mem\<^sub>1; mds' = mds; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> P'' \<turnstile> P'''
[PROOF STEP]
apply simp+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''

goal (4 subgoals):
 1. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have ev\<^sub>B_eq [simp]: "ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e
[PROOF STEP]
apply(rule ev\<^sub>B_eq')
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. mem\<^sub>1 =\<^bsub>?\<Gamma>\<^esub> mem\<^sub>2
 2. pred ?P mem\<^sub>1
 3. ?\<Gamma> \<turnstile>\<^sub>b e \<in> ?t
 4. ?P \<turnstile> ?t
[PROOF STEP]
apply(rule \<open>mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2\<close>)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. pred ?P mem\<^sub>1
 2. \<Gamma> \<turnstile>\<^sub>b e \<in> ?t
 3. ?P \<turnstile> ?t
[PROOF STEP]
apply(rule \<open>pred P mem\<^sub>1\<close>)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<Gamma> \<turnstile>\<^sub>b e \<in> ?t
 2. P \<turnstile> ?t
[PROOF STEP]
apply(rule \<open>\<Gamma> \<turnstile>\<^sub>b e \<in> t\<close>)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<turnstile> t
[PROOF STEP]
by(rule \<open> P \<turnstile> t\<close>)
[PROOF STATE]
proof (state)
this:
ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e

goal (4 subgoals):
 1. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "(\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle>, \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>) \<in> \<R> \<Gamma>''' \<S>' P'''"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
apply (rule intro\<^sub>1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case \<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> of (x, xa) \<Rightarrow> (case x of (x, xa) \<Rightarrow> \<lambda>xb ((xc, xd), xe). \<langle>x, xa, xb\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>xc, xd, xe\<rangle>) xa) \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
apply (rule \<R>\<^sub>1.intro [where \<Gamma> = \<Gamma> and \<Gamma>' = \<Gamma>''' and \<S> = \<S> and P = ?P])
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<turnstile> \<Gamma>,\<S>,(if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) {c\<^sub>1'} \<Gamma>''',\<S>',P'''
 2. tyenv_wellformed mds \<Gamma> \<S> (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e)
 3. mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
 4. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>1
 5. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>2
 6. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(rule ty)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e)
 2. mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
 3. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>1
 4. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>2
 5. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using \<open>tyenv_wellformed mds \<Gamma> \<S> P\<close>
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P

goal (5 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e)
 2. mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
 3. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>1
 4. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>2
 5. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(auto simp: tyenv_wellformed_def mds_consistent_def add_pred_def)[1]
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
 2. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>1
 3. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>2
 4. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(rule \<open>mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2\<close>)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>1
 2. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>2
 3. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using \<open>pred P mem\<^sub>1\<close>
[PROOF STATE]
proof (prove)
using this:
pred P mem\<^sub>1

goal (3 subgoals):
 1. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>1
 2. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>2
 3. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(fastforce simp: pred_def add_pred_def bexp_neg_negates)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>2
 2. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using \<open>pred P mem\<^sub>2\<close>
[PROOF STATE]
proof (prove)
using this:
pred P mem\<^sub>2

goal (2 subgoals):
 1. pred (if ev\<^sub>B mem\<^sub>1 e then P +\<^sub>\<S> e else P +\<^sub>\<S> bexp_neg e) mem\<^sub>2
 2. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(fastforce simp: pred_def add_pred_def bexp_neg_negates)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
by(rule \<open>tyenv_sec mds \<Gamma> mem\<^sub>1\<close>)
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>

goal (4 subgoals):
 1. \<And>\<Gamma> e t P \<S> c\<^sub>1 \<Gamma>' \<S>' P' c\<^sub>2 \<Gamma>'' P'' \<Gamma>''' P''' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c\<^sub>1} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>1, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {c\<^sub>2} \<Gamma>'',\<S>',P''; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>1; pred P +\<^sub>\<S> bexp_neg e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>'',\<S>',P''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>' =:\<^sub>P' \<Gamma>'''; \<Gamma>'' =:\<^sub>P'' \<Gamma>'''; P' \<turnstile> P'''; P'' \<turnstile> P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; \<forall>mds. tyenv_wellformed mds \<Gamma>'' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>''' \<S>' P'''; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e c\<^sub>1 c\<^sub>2, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 4. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from ev\<^sub>B_eq if_type(13)
[PROOF STATE]
proof (chain)
picking this:
ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e
tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
have "(\<langle>If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>)"
[PROOF STATE]
proof (prove)
using this:
ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e
tyenv_wellformed mds \<Gamma> \<S> P

goal (1 subgoal):
 1. \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
apply (cases "ev\<^sub>B mem\<^sub>1 e")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
 2. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
apply (subgoal_tac "c\<^sub>1' = th")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; ev\<^sub>B mem\<^sub>1 e; c\<^sub>1' = th\<rbrakk> \<Longrightarrow> \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
 2. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> c\<^sub>1' = th
 3. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; ev\<^sub>B mem\<^sub>1 e; c\<^sub>1' = th; ev\<^sub>B mem\<^sub>1 e; ev\<^sub>B mem\<^sub>2 e\<rbrakk> \<Longrightarrow> \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>th, mds, mem\<^sub>2\<rangle>
 2. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> c\<^sub>1' = th
 3. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
apply (metis cxt_to_stmt.simps(1) eval\<^sub>w_simplep.if_true eval\<^sub>wp.unannotated eval\<^sub>wp_eval\<^sub>w_eq if_type(8))
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> c\<^sub>1' = th
 2. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
using if_type.prems(6)
[PROOF STATE]
proof (prove)
using this:
\<langle>Stmt.If e th el, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (2 subgoals):
 1. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> c\<^sub>1' = th
 2. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
apply (subgoal_tac "c\<^sub>1' = el")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; \<not> ev\<^sub>B mem\<^sub>1 e; c\<^sub>1' = el\<rbrakk> \<Longrightarrow> \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
 2. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> c\<^sub>1' = el
[PROOF STEP]
apply (metis (opaque_lifting, mono_tags) cxt_to_stmt.simps(1) eval\<^sub>w.unannotated eval\<^sub>w_simple.if_false if_type(8))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> c\<^sub>1' = el
[PROOF STEP]
using if_type.prems(6)
[PROOF STATE]
proof (prove)
using this:
\<langle>Stmt.If e th el, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. \<lbrakk>ev\<^sub>B mem\<^sub>1 e = ev\<^sub>B mem\<^sub>2 e; tyenv_wellformed mds \<Gamma> \<S> P; \<not> ev\<^sub>B mem\<^sub>1 e\<rbrakk> \<Longrightarrow> c\<^sub>1' = el
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
with \<open>\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>\<close>
[PROOF STATE]
proof (chain)
picking this:
\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
\<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
\<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by (metis if_elim if_type.prems(6))
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Stmt.If e th el, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>''',\<S>',P'''\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (3 subgoals):
 1. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
(* while *)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
case (while_type \<Gamma> e t P \<S> c)
[PROOF STATE]
proof (state)
this:
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (3 subgoals):
 1. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
hence [simp]: "c\<^sub>1' = (If e (c ;; While e c) Stop)" and
    [simp]: "mds' = mds" and
    [simp]: "mem\<^sub>1' = mem\<^sub>1"
[PROOF STATE]
proof (prove)
using this:
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. c\<^sub>1' = Stmt.If e (c ;; While e c) Stop &&& mds' = mds &&& mem\<^sub>1' = mem\<^sub>1
[PROOF STEP]
by (auto simp: while_elim)
[PROOF STATE]
proof (state)
this:
c\<^sub>1' = Stmt.If e (c ;; While e c) Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1

goal (3 subgoals):
 1. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
with while_type
[PROOF STATE]
proof (chain)
picking this:
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1' = Stmt.If e (c ;; While e c) Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1
[PROOF STEP]
have "\<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>"
[PROOF STATE]
proof (prove)
using this:
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
c\<^sub>1' = Stmt.If e (c ;; While e c) Stop
mds' = mds
mem\<^sub>1' = mem\<^sub>1

goal (1 subgoal):
 1. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
by (metis cxt_to_stmt.simps(1) eval\<^sub>w_simplep.while eval\<^sub>wp.unannotated eval\<^sub>wp_eval\<^sub>w_eq)
[PROOF STATE]
proof (state)
this:
\<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>

goal (3 subgoals):
 1. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>

goal (3 subgoals):
 1. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have ty: " \<turnstile> \<Gamma>,\<S>,P {c\<^sub>1'} \<Gamma>,\<S>,P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<turnstile> \<Gamma>,\<S>,P {c\<^sub>1'} \<Gamma>,\<S>,P
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<turnstile> \<Gamma>,\<S>,P {Stmt.If e (c ;; While e c) Stop} \<Gamma>,\<S>,P
[PROOF STEP]
apply(rule if_type)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<Gamma> \<turnstile>\<^sub>b e \<in> ?t1
 2. P \<turnstile> ?t1
 3. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c ;; While e c} ?\<Gamma>'1,\<S>,?P'1
 4. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {Stop} ?\<Gamma>''1,\<S>,?P''1
 5. ?\<Gamma>'1 =:\<^sub>?P'1 \<Gamma>
 6. ?\<Gamma>''1 =:\<^sub>?P''1 \<Gamma>
 7. ?P'1 \<turnstile> P
 8. ?P''1 \<turnstile> P
 9. \<forall>mds. tyenv_wellformed mds ?\<Gamma>'1 \<S> ?P'1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 10. \<forall>mds. tyenv_wellformed mds ?\<Gamma>''1 \<S> ?P''1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply(rule while_type(1))
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. P \<turnstile> t
 2. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c ;; While e c} ?\<Gamma>'1,\<S>,?P'1
 3. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {Stop} ?\<Gamma>''1,\<S>,?P''1
 4. ?\<Gamma>'1 =:\<^sub>?P'1 \<Gamma>
 5. ?\<Gamma>''1 =:\<^sub>?P''1 \<Gamma>
 6. ?P'1 \<turnstile> P
 7. ?P''1 \<turnstile> P
 8. \<forall>mds. tyenv_wellformed mds ?\<Gamma>'1 \<S> ?P'1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 9. \<forall>mds. tyenv_wellformed mds ?\<Gamma>''1 \<S> ?P''1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply(rule while_type(2))
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c ;; While e c} ?\<Gamma>'1,\<S>,?P'1
 2. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {Stop} ?\<Gamma>''1,\<S>,?P''1
 3. ?\<Gamma>'1 =:\<^sub>?P'1 \<Gamma>
 4. ?\<Gamma>''1 =:\<^sub>?P''1 \<Gamma>
 5. ?P'1 \<turnstile> P
 6. ?P''1 \<turnstile> P
 7. \<forall>mds. tyenv_wellformed mds ?\<Gamma>'1 \<S> ?P'1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 8. \<forall>mds. tyenv_wellformed mds ?\<Gamma>''1 \<S> ?P''1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply(rule seq_type)
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} ?\<Gamma>'12,?\<S>'12,?P'12
 2. \<turnstile> ?\<Gamma>'12,?\<S>'12,?P'12 {While e c} ?\<Gamma>'1,\<S>,?P'1
 3. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {Stop} ?\<Gamma>''1,\<S>,?P''1
 4. ?\<Gamma>'1 =:\<^sub>?P'1 \<Gamma>
 5. ?\<Gamma>''1 =:\<^sub>?P''1 \<Gamma>
 6. ?P'1 \<turnstile> P
 7. ?P''1 \<turnstile> P
 8. \<forall>mds. tyenv_wellformed mds ?\<Gamma>'1 \<S> ?P'1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 9. \<forall>mds. tyenv_wellformed mds ?\<Gamma>''1 \<S> ?P''1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply(rule while_type(3))
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<turnstile> \<Gamma>,\<S>,P {While e c} ?\<Gamma>'1,\<S>,?P'1
 2. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {Stop} ?\<Gamma>''1,\<S>,?P''1
 3. ?\<Gamma>'1 =:\<^sub>?P'1 \<Gamma>
 4. ?\<Gamma>''1 =:\<^sub>?P''1 \<Gamma>
 5. ?P'1 \<turnstile> P
 6. ?P''1 \<turnstile> P
 7. \<forall>mds. tyenv_wellformed mds ?\<Gamma>'1 \<S> ?P'1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 8. \<forall>mds. tyenv_wellformed mds ?\<Gamma>''1 \<S> ?P''1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply(rule has_type.while_type)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<Gamma> \<turnstile>\<^sub>b e \<in> ?t15
 2. P \<turnstile> ?t15
 3. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P
 4. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {Stop} ?\<Gamma>''1,\<S>,?P''1
 5. \<Gamma> =:\<^sub>P \<Gamma>
 6. ?\<Gamma>''1 =:\<^sub>?P''1 \<Gamma>
 7. P \<turnstile> P
 8. ?P''1 \<turnstile> P
 9. \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 10. \<forall>mds. tyenv_wellformed mds ?\<Gamma>''1 \<S> ?P''1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply(rule while_type(1))
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. P \<turnstile> t
 2. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P
 3. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {Stop} ?\<Gamma>''1,\<S>,?P''1
 4. \<Gamma> =:\<^sub>P \<Gamma>
 5. ?\<Gamma>''1 =:\<^sub>?P''1 \<Gamma>
 6. P \<turnstile> P
 7. ?P''1 \<turnstile> P
 8. \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 9. \<forall>mds. tyenv_wellformed mds ?\<Gamma>''1 \<S> ?P''1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply(rule while_type(2))
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P
 2. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {Stop} ?\<Gamma>''1,\<S>,?P''1
 3. \<Gamma> =:\<^sub>P \<Gamma>
 4. ?\<Gamma>''1 =:\<^sub>?P''1 \<Gamma>
 5. P \<turnstile> P
 6. ?P''1 \<turnstile> P
 7. \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 8. \<forall>mds. tyenv_wellformed mds ?\<Gamma>''1 \<S> ?P''1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply(rule while_type(3))
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> bexp_neg e {Stop} ?\<Gamma>''1,\<S>,?P''1
 2. \<Gamma> =:\<^sub>P \<Gamma>
 3. ?\<Gamma>''1 =:\<^sub>?P''1 \<Gamma>
 4. P \<turnstile> P
 5. ?P''1 \<turnstile> P
 6. \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 7. \<forall>mds. tyenv_wellformed mds ?\<Gamma>''1 \<S> ?P''1 \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply(rule stop_type)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<Gamma> =:\<^sub>P \<Gamma>
 2. \<Gamma> =:\<^sub>P +\<^sub>\<S> bexp_neg e \<Gamma>
 3. P \<turnstile> P
 4. P +\<^sub>\<S> bexp_neg e \<turnstile> P
 5. \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 6. \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply simp+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. P +\<^sub>\<S> bexp_neg e \<turnstile> P
 2. \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 3. \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply(rule add_pred_entailment)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
 2. \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>mds. tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> bexp_neg e \<longrightarrow> tyenv_wellformed mds \<Gamma> \<S> P
[PROOF STEP]
apply(blast intro!: add_pred_subset tyenv_wellformed_subset)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1'} \<Gamma>,\<S>,P

goal (3 subgoals):
 1. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1'} \<Gamma>,\<S>,P

goal (3 subgoals):
 1. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have "\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
apply (rule \<R>\<^sub>1.intro [where \<Gamma> = \<Gamma>])
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<turnstile> \<Gamma>,?\<S>,?P {c\<^sub>1'} \<Gamma>,\<S>,P
 2. tyenv_wellformed mds \<Gamma> ?\<S> ?P
 3. mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
 4. pred ?P mem\<^sub>1
 5. pred ?P mem\<^sub>2
 6. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply(rule ty)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P
 2. mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
 3. pred P mem\<^sub>1
 4. pred P mem\<^sub>2
 5. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using while_type
[PROOF STATE]
proof (prove)
using this:
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (5 subgoals):
 1. tyenv_wellformed mds \<Gamma> \<S> P
 2. mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
 3. pred P mem\<^sub>1
 4. pred P mem\<^sub>2
 5. \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply simp+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>

goal (3 subgoals):
 1. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
hence "\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>"
[PROOF STATE]
proof (prove)
using this:
\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>

goal (1 subgoal):
 1. \<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
using \<R>.intro\<^sub>1
[PROOF STATE]
proof (prove)
using this:
\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
(case ?lc of (x, xa) \<Rightarrow> (case x of (x, xa) \<Rightarrow> \<lambda>xb ((xc, xd), xe). \<langle>x, xa, xb\<rangle> \<R>\<^sup>1\<^bsub>?\<Gamma>,?\<S>,?P\<^esub> \<langle>xc, xd, xe\<rangle>) xa) ?lc' \<Longrightarrow> ?lc \<R>\<^sup>u\<^bsub>?\<Gamma>,?\<S>,?P\<^esub> ?lc'

goal (1 subgoal):
 1. \<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>

goal (3 subgoals):
 1. \<And>\<Gamma> e t P \<S> c mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>,\<S>,P; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>While e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 3. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1'} \<Gamma>,\<S>,P
\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>
\<turnstile> \<Gamma>,\<S>,P {c\<^sub>1'} \<Gamma>,\<S>,P
\<langle>c\<^sub>1', mds, mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>1', mds, mem\<^sub>2\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>While e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (2 subgoals):
 1. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
case (sub \<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1')
[PROOF STATE]
proof (state)
this:
\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1
\<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1
\<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'
\<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'
P\<^sub>2 \<turnstile> P\<^sub>1
P\<^sub>1' \<turnstile> P\<^sub>2'
tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2
mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2
pred P\<^sub>2 mem\<^sub>1
pred P\<^sub>2 mem\<^sub>2
\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (2 subgoals):
 1. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have imp: "tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> pred P\<^sub>2 mem\<^sub>1 \<and> pred P\<^sub>2 mem\<^sub>2 \<and> tyenv_sec mds \<Gamma>\<^sub>2 mem\<^sub>1 \<Longrightarrow>
             tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>2 \<and> tyenv_sec mds \<Gamma>\<^sub>1 mem\<^sub>1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> pred P\<^sub>2 mem\<^sub>1 \<and> pred P\<^sub>2 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> pred P\<^sub>2 mem\<^sub>1 \<and> pred P\<^sub>2 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1
 2. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> pred P\<^sub>2 mem\<^sub>1 \<and> pred P\<^sub>2 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> pred P\<^sub>1 mem\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
[PROOF STEP]
using sub(5) sub(4) tyenv_wellformed_sub
[PROOF STATE]
proof (prove)
using this:
\<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'
\<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1
\<lbrakk>?P\<^sub>1 \<subseteq> ?P\<^sub>2; ?\<Gamma>\<^sub>2 = ?\<Gamma>\<^sub>1; tyenv_wellformed ?mds ?\<Gamma>\<^sub>2 ?\<S> ?P\<^sub>2\<rbrakk> \<Longrightarrow> tyenv_wellformed ?mds ?\<Gamma>\<^sub>1 ?\<S> ?P\<^sub>1

goal (2 subgoals):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> pred P\<^sub>2 mem\<^sub>1 \<and> pred P\<^sub>2 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1
 2. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> pred P\<^sub>2 mem\<^sub>1 \<and> pred P\<^sub>2 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> pred P\<^sub>1 mem\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
[PROOF STEP]
unfolding pred_def
[PROOF STATE]
proof (prove)
using this:
\<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'
\<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1
\<lbrakk>?P\<^sub>1 \<subseteq> ?P\<^sub>2; ?\<Gamma>\<^sub>2 = ?\<Gamma>\<^sub>1; tyenv_wellformed ?mds ?\<Gamma>\<^sub>2 ?\<S> ?P\<^sub>2\<rbrakk> \<Longrightarrow> tyenv_wellformed ?mds ?\<Gamma>\<^sub>1 ?\<S> ?P\<^sub>1

goal (2 subgoals):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1
 2. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> Ball P\<^sub>1 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>1 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> Ball P\<^sub>1 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>1 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> Ball P\<^sub>1 (ev\<^sub>B mem\<^sub>1)
 2. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> Ball P\<^sub>1 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
[PROOF STEP]
using local.pred_def pred_entailment_def sub.hyps(7)
[PROOF STATE]
proof (prove)
using this:
pred ?P \<equiv> \<lambda>mem. \<forall>p\<in>?P. ev\<^sub>B mem p
?P \<turnstile> ?P' \<equiv> \<forall>mem. pred ?P mem \<longrightarrow> pred ?P' mem
P\<^sub>2 \<turnstile> P\<^sub>1

goal (2 subgoals):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> Ball P\<^sub>1 (ev\<^sub>B mem\<^sub>1)
 2. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> Ball P\<^sub>1 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
[PROOF STEP]
apply auto[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> Ball P\<^sub>1 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> Ball P\<^sub>1 (ev\<^sub>B mem\<^sub>2)
 2. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using local.pred_def pred_entailment_def sub.hyps(7)
[PROOF STATE]
proof (prove)
using this:
pred ?P \<equiv> \<lambda>mem. \<forall>p\<in>?P. ev\<^sub>B mem p
?P \<turnstile> ?P' \<equiv> \<forall>mem. pred ?P mem \<longrightarrow> pred ?P' mem
P\<^sub>2 \<turnstile> P\<^sub>1

goal (2 subgoals):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> Ball P\<^sub>1 (ev\<^sub>B mem\<^sub>2)
 2. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
apply auto[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
using sub(3) context_equiv_tyenv_sec
[PROOF STATE]
proof (prove)
using this:
\<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1
\<lbrakk>?\<Gamma>\<^sub>2 =:\<^sub>?P\<^sub>2 ?\<Gamma>\<^sub>1; pred ?P\<^sub>2 ?mem; \<forall>x\<in>dom ?\<Gamma>\<^sub>2. x \<notin> ?mds AsmNoReadOrWrite \<longrightarrow> type_max (the (?\<Gamma>\<^sub>2 x)) ?mem \<le> dma ?mem x\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom ?\<Gamma>\<^sub>1. x \<notin> ?mds AsmNoReadOrWrite \<longrightarrow> type_max (the (?\<Gamma>\<^sub>1 x)) ?mem \<le> dma ?mem x

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
unfolding pred_def
[PROOF STATE]
proof (prove)
using this:
\<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1
\<lbrakk>?\<Gamma>\<^sub>2 =:\<^sub>?P\<^sub>2 ?\<Gamma>\<^sub>1; Ball ?P\<^sub>2 (ev\<^sub>B ?mem); \<forall>x\<in>dom ?\<Gamma>\<^sub>2. x \<notin> ?mds AsmNoReadOrWrite \<longrightarrow> type_max (the (?\<Gamma>\<^sub>2 x)) ?mem \<le> dma ?mem x\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom ?\<Gamma>\<^sub>1. x \<notin> ?mds AsmNoReadOrWrite \<longrightarrow> type_max (the (?\<Gamma>\<^sub>1 x)) ?mem \<le> dma ?mem x

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>1) \<and> Ball P\<^sub>2 (ev\<^sub>B mem\<^sub>2) \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> pred P\<^sub>2 mem\<^sub>1 \<and> pred P\<^sub>2 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)

goal (2 subgoals):
 1. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
have tyenv_eq: "mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2
[PROOF STEP]
using context_equiv_tyenv_eq sub
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?mem =\<^bsub>?\<Gamma>\<^esub> ?mem'; ?\<Gamma> =:\<^sub>?P ?\<Gamma>'; pred ?P ?mem\<rbrakk> \<Longrightarrow> ?mem =\<^bsub>?\<Gamma>'\<^esub> ?mem'
\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1
\<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1
\<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'
\<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'
P\<^sub>2 \<turnstile> P\<^sub>1
P\<^sub>1' \<turnstile> P\<^sub>2'
tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2
mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2
pred P\<^sub>2 mem\<^sub>1
pred P\<^sub>2 mem\<^sub>2
\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2

goal (2 subgoals):
 1. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from imp tyenv_eq
[PROOF STATE]
proof (chain)
picking this:
tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> pred P\<^sub>2 mem\<^sub>1 \<and> pred P\<^sub>2 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2
[PROOF STEP]
obtain c\<^sub>2' mem\<^sub>2' where c\<^sub>2'_props: "\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>"
    "\<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> pred P\<^sub>2 mem\<^sub>1 \<and> pred P\<^sub>2 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2

goal (1 subgoal):
 1. (\<And>c\<^sub>2' mem\<^sub>2'. \<lbrakk>\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using sub
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<and> pred P\<^sub>2 mem\<^sub>1 \<and> pred P\<^sub>2 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x) \<Longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>1 \<and> pred P\<^sub>1 mem\<^sub>2 \<and> (\<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x)
mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2
\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1
\<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1
\<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'
\<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'
P\<^sub>2 \<turnstile> P\<^sub>1
P\<^sub>1' \<turnstile> P\<^sub>2'
tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2
mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2
pred P\<^sub>2 mem\<^sub>1
pred P\<^sub>2 mem\<^sub>2
\<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. (\<And>c\<^sub>2' mem\<^sub>2'. \<lbrakk>\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (2 subgoals):
 1. \<And>\<Gamma>\<^sub>1 \<S> P\<^sub>1 c \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<Gamma>\<^sub>2 P\<^sub>2 \<Gamma>\<^sub>2' P\<^sub>2' mds c\<^sub>1'. \<lbrakk>\<turnstile> \<Gamma>\<^sub>1,\<S>,P\<^sub>1 {c} \<Gamma>\<^sub>1',\<S>',P\<^sub>1'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>1\<^esub> mem\<^sub>2; pred P\<^sub>1 mem\<^sub>1; pred P\<^sub>1 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>1. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>1 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<Gamma>\<^sub>2 =:\<^sub>P\<^sub>2 \<Gamma>\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2 \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>1 \<S> P\<^sub>1; \<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'; \<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'; P\<^sub>2 \<turnstile> P\<^sub>1; P\<^sub>1' \<turnstile> P\<^sub>2'; tyenv_wellformed mds \<Gamma>\<^sub>2 \<S> P\<^sub>2; mem\<^sub>1 =\<^bsub>\<Gamma>\<^sub>2\<^esub> mem\<^sub>2; pred P\<^sub>2 mem\<^sub>1; pred P\<^sub>2 mem\<^sub>2; \<forall>x\<in>dom \<Gamma>\<^sub>2. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma>\<^sub>2 x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
 2. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
with R_equiv_entailment \<open>P\<^sub>1' \<turnstile> P\<^sub>2'\<close>
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?lc\<^sub>1 \<R>\<^sup>u\<^bsub>?\<Gamma>',?\<S>',?P'\<^esub> ?lc\<^sub>2; ?\<Gamma>' =:\<^sub>?P' ?\<Gamma>''; ?P' \<turnstile> ?P''; \<forall>mds. tyenv_wellformed mds ?\<Gamma>' ?\<S>' ?P' \<longrightarrow> tyenv_wellformed mds ?\<Gamma>'' ?\<S>' ?P''\<rbrakk> \<Longrightarrow> ?lc\<^sub>1 \<R>\<^sup>u\<^bsub>?\<Gamma>'',?\<S>',?P''\<^esub> ?lc\<^sub>2
P\<^sub>1' \<turnstile> P\<^sub>2'
\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?lc\<^sub>1 \<R>\<^sup>u\<^bsub>?\<Gamma>',?\<S>',?P'\<^esub> ?lc\<^sub>2; ?\<Gamma>' =:\<^sub>?P' ?\<Gamma>''; ?P' \<turnstile> ?P''; \<forall>mds. tyenv_wellformed mds ?\<Gamma>' ?\<S>' ?P' \<longrightarrow> tyenv_wellformed mds ?\<Gamma>'' ?\<S>' ?P''\<rbrakk> \<Longrightarrow> ?lc\<^sub>1 \<R>\<^sup>u\<^bsub>?\<Gamma>'',?\<S>',?P''\<^esub> ?lc\<^sub>2
P\<^sub>1' \<turnstile> P\<^sub>2'
\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
using sub.hyps(6) sub.hyps(5)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?lc\<^sub>1 \<R>\<^sup>u\<^bsub>?\<Gamma>',?\<S>',?P'\<^esub> ?lc\<^sub>2; ?\<Gamma>' =:\<^sub>?P' ?\<Gamma>''; ?P' \<turnstile> ?P''; \<forall>mds. tyenv_wellformed mds ?\<Gamma>' ?\<S>' ?P' \<longrightarrow> tyenv_wellformed mds ?\<Gamma>'' ?\<S>' ?P''\<rbrakk> \<Longrightarrow> ?lc\<^sub>1 \<R>\<^sup>u\<^bsub>?\<Gamma>'',?\<S>',?P''\<^esub> ?lc\<^sub>2
P\<^sub>1' \<turnstile> P\<^sub>2'
\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>1',\<S>',P\<^sub>1'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<Gamma>\<^sub>1' =:\<^sub>P\<^sub>1' \<Gamma>\<^sub>2'
\<forall>mds. tyenv_wellformed mds \<Gamma>\<^sub>1' \<S>' P\<^sub>1' \<longrightarrow> tyenv_wellformed mds \<Gamma>\<^sub>2' \<S>' P\<^sub>2'

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>\<^sub>2',\<S>',P\<^sub>2'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal (1 subgoal):
 1. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
case (await_type \<Gamma> e t P \<S> c \<Gamma>' \<S>' P')
[PROOF STATE]
proof (state)
this:
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'
\<lbrakk>tyenv_wellformed ?mds5 \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> ?mds5 AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, ?mds5, mem\<^sub>1\<rangle> \<leadsto> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, ?mds5, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1'5, mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from await_type.prems
[PROOF STATE]
proof (chain)
picking this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
[PROOF STEP]
have "ev\<^sub>B mem\<^sub>1 e" "no_await c" "is_final c\<^sub>1'" and step: "\<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. (ev\<^sub>B mem\<^sub>1 e &&& no_await c &&& is_final c\<^sub>1') &&& \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
[PROOF STEP]
using await_elim
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
\<langle>Await ?b ?c\<^sub>1, ?mds, ?mem\<rangle> \<leadsto> \<langle>?c\<^sub>2, ?mds', ?mem'\<rangle> \<Longrightarrow> ev\<^sub>B ?mem ?b \<and> no_await ?c\<^sub>1 \<and> is_final ?c\<^sub>2 \<and> \<langle>?c\<^sub>1, ?mds, ?mem\<rangle> \<leadsto>\<^sup>+ \<langle>?c\<^sub>2, ?mds', ?mem'\<rangle>

goal (1 subgoal):
 1. (ev\<^sub>B mem\<^sub>1 e &&& no_await c &&& is_final c\<^sub>1') &&& \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
[PROOF STEP]
by simp+
[PROOF STATE]
proof (state)
this:
ev\<^sub>B mem\<^sub>1 e
no_await c
is_final c\<^sub>1'
\<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>

goal (1 subgoal):
 1. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from await_type.prems \<open>\<Gamma> \<turnstile>\<^sub>b e \<in> t\<close> \<open>P \<turnstile> t\<close>
[PROOF STATE]
proof (chain)
picking this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
[PROOF STEP]
have "pred P +\<^sub>\<S> e mem\<^sub>1" "pred P +\<^sub>\<S> e mem\<^sub>2" "ev\<^sub>B mem\<^sub>2 e"
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t

goal (1 subgoal):
 1. pred P +\<^sub>\<S> e mem\<^sub>1 &&& pred P +\<^sub>\<S> e mem\<^sub>2 &&& ev\<^sub>B mem\<^sub>2 e
[PROOF STEP]
using pred_plus_impl \<open>ev\<^sub>B mem\<^sub>1 e\<close> \<open>pred P mem\<^sub>1\<close> ev\<^sub>B_eq'
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
\<lbrakk>pred ?P ?mem; ev\<^sub>B ?mem ?e\<rbrakk> \<Longrightarrow> pred ?P +\<^sub>?S ?e ?mem
ev\<^sub>B mem\<^sub>1 e
pred P mem\<^sub>1
\<lbrakk>?mem\<^sub>1 =\<^bsub>?\<Gamma>\<^esub> ?mem\<^sub>2; pred ?P ?mem\<^sub>1; ?\<Gamma> \<turnstile>\<^sub>b ?e \<in> ?t ; ?P \<turnstile> ?t\<rbrakk> \<Longrightarrow> ev\<^sub>B ?mem\<^sub>1 ?e = ev\<^sub>B ?mem\<^sub>2 ?e

goal (1 subgoal):
 1. pred P +\<^sub>\<S> e mem\<^sub>1 &&& pred P +\<^sub>\<S> e mem\<^sub>2 &&& ev\<^sub>B mem\<^sub>2 e
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
pred P +\<^sub>\<S> e mem\<^sub>1
pred P +\<^sub>\<S> e mem\<^sub>2
ev\<^sub>B mem\<^sub>2 e

goal (1 subgoal):
 1. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from await_type.prems \<open>\<Gamma> \<turnstile>\<^sub>b e \<in> t\<close> \<open>P \<turnstile> t\<close>
[PROOF STATE]
proof (chain)
picking this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
[PROOF STEP]
have wellformed: "tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e"
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t

goal (1 subgoal):
 1. tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e
[PROOF STEP]
apply (unfold add_pred_def)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>; \<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t\<rbrakk> \<Longrightarrow> tyenv_wellformed mds \<Gamma> \<S> (if pred_stable \<S> e then P \<union> {e} else P)
[PROOF STEP]
apply (case_tac "pred_stable \<S> e", clarsimp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>; \<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; pred_stable \<S> e\<rbrakk> \<Longrightarrow> tyenv_wellformed mds \<Gamma> \<S> (insert e P)
 2. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>; \<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<not> pred_stable \<S> e\<rbrakk> \<Longrightarrow> tyenv_wellformed mds \<Gamma> \<S> (if pred_stable \<S> e then P \<union> {e} else P)
[PROOF STEP]
apply (unfold tyenv_wellformed_def, clarsimp)[1]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>; \<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; pred_stable \<S> e; mds_consistent mds \<Gamma> \<S> P; types_wellformed \<Gamma>; types_stable \<Gamma> \<S>\<rbrakk> \<Longrightarrow> mds_consistent mds \<Gamma> \<S> (insert e P)
 2. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>; \<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<not> pred_stable \<S> e\<rbrakk> \<Longrightarrow> tyenv_wellformed mds \<Gamma> \<S> (if pred_stable \<S> e then P \<union> {e} else P)
[PROOF STEP]
apply (unfold mds_consistent_def, clarsimp)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>; \<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<not> pred_stable \<S> e\<rbrakk> \<Longrightarrow> tyenv_wellformed mds \<Gamma> \<S> (if pred_stable \<S> e then P \<union> {e} else P)
[PROOF STEP]
by clarsimp
[PROOF STATE]
proof (state)
this:
tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e

goal (1 subgoal):
 1. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from step \<open>is_final c\<^sub>1'\<close> \<open>no_await c\<close> \<open>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e\<close> await_type.prems \<open>pred P +\<^sub>\<S> e mem\<^sub>1\<close> \<open>pred P +\<^sub>\<S> e mem\<^sub>2\<close>
[PROOF STATE]
proof (chain)
picking this:
\<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
is_final c\<^sub>1'
no_await c
tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
pred P +\<^sub>\<S> e mem\<^sub>1
pred P +\<^sub>\<S> e mem\<^sub>2
[PROOF STEP]
obtain c\<^sub>2' mem\<^sub>2' where step: "\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>" and
      rel: "\<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>" "is_final c\<^sub>2'"
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
is_final c\<^sub>1'
no_await c
tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
pred P +\<^sub>\<S> e mem\<^sub>1
pred P +\<^sub>\<S> e mem\<^sub>2

goal (1 subgoal):
 1. (\<And>c\<^sub>2' mem\<^sub>2'. \<lbrakk>\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; is_final c\<^sub>2'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<R>_typed_step_plus await_type.hyps(3) is_final_\<R>\<^sub>u_is_final
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
is_final c\<^sub>1'
no_await c
tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e
tyenv_wellformed mds \<Gamma> \<S> P
mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2
pred P mem\<^sub>1
pred P mem\<^sub>2
\<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x
\<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>
pred P +\<^sub>\<S> e mem\<^sub>1
pred P +\<^sub>\<S> e mem\<^sub>2
\<lbrakk>\<langle>?c\<^sub>1, ?mds, ?mem\<^sub>1\<rangle> \<leadsto>\<^sup>+ \<langle>?c\<^sub>1', ?mds', ?mem\<^sub>1'\<rangle>; \<turnstile> ?\<Gamma>,?\<S>,?P {?c\<^sub>1} ?\<Gamma>',?\<S>',?P'; no_await ?c\<^sub>1; tyenv_wellformed ?mds ?\<Gamma> ?\<S> ?P; ?mem\<^sub>1 =\<^bsub>?\<Gamma>\<^esub> ?mem\<^sub>2; pred ?P ?mem\<^sub>1; pred ?P ?mem\<^sub>2; \<forall>x\<in>dom ?\<Gamma>. x \<notin> ?mds AsmNoReadOrWrite \<longrightarrow> type_max (the (?\<Gamma> x)) ?mem\<^sub>1 \<le> dma ?mem\<^sub>1 x\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>?c\<^sub>1, ?mds, ?mem\<^sub>2\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>2', ?mds', mem\<^sub>2'\<rangle> \<and> \<langle>?c\<^sub>1', ?mds', ?mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>?\<Gamma>',?\<S>',?P'\<^esub> \<langle>c\<^sub>2', ?mds', mem\<^sub>2'\<rangle>
\<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'
\<lbrakk>\<langle>?c\<^sub>1, ?mds, ?mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>?\<Gamma>,?\<S>,?P\<^esub> \<langle>?c\<^sub>2, ?mds, ?mem\<^sub>2\<rangle>; is_final ?c\<^sub>1\<rbrakk> \<Longrightarrow> is_final ?c\<^sub>2

goal (1 subgoal):
 1. (\<And>c\<^sub>2' mem\<^sub>2'. \<lbrakk>\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; is_final c\<^sub>2'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
is_final c\<^sub>2'

goal (1 subgoal):
 1. \<And>\<Gamma> e t P \<S> c \<Gamma>' \<S>' P' mds c\<^sub>1'. \<lbrakk>\<Gamma> \<turnstile>\<^sub>b e \<in> t ; P \<turnstile> t; \<turnstile> \<Gamma>,\<S>,P +\<^sub>\<S> e {c} \<Gamma>',\<S>',P'; \<And>mds c\<^sub>1'. \<lbrakk>tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P +\<^sub>\<S> e mem\<^sub>1; pred P +\<^sub>\<S> e mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>; tyenv_wellformed mds \<Gamma> \<S> P; mem\<^sub>1 =\<^bsub>\<Gamma>\<^esub> mem\<^sub>2; pred P mem\<^sub>1; pred P mem\<^sub>2; \<forall>x\<in>dom \<Gamma>. x \<notin> mds AsmNoReadOrWrite \<longrightarrow> type_max (the (\<Gamma> x)) mem\<^sub>1 \<le> dma mem\<^sub>1 x; \<langle>Await e c, mds, mem\<^sub>1\<rangle> \<leadsto> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
from wellformed \<open>is_final c\<^sub>2'\<close> \<open>ev\<^sub>B mem\<^sub>2 e\<close> \<open>no_await c\<close> \<open>\<Gamma> \<turnstile>\<^sub>b e \<in> t\<close> \<open>P \<turnstile> t\<close> \<open>pred P +\<^sub>\<S> e mem\<^sub>2\<close> step rel
[PROOF STATE]
proof (chain)
picking this:
tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e
is_final c\<^sub>2'
ev\<^sub>B mem\<^sub>2 e
no_await c
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
pred P +\<^sub>\<S> e mem\<^sub>2
\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
is_final c\<^sub>2'
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e
is_final c\<^sub>2'
ev\<^sub>B mem\<^sub>2 e
no_await c
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
pred P +\<^sub>\<S> e mem\<^sub>2
\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
is_final c\<^sub>2'

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
using eval\<^sub>w.intros(4)
[PROOF STATE]
proof (prove)
using this:
tyenv_wellformed mds \<Gamma> \<S> P +\<^sub>\<S> e
is_final c\<^sub>2'
ev\<^sub>B mem\<^sub>2 e
no_await c
\<Gamma> \<turnstile>\<^sub>b e \<in> t
P \<turnstile> t
pred P +\<^sub>\<S> e mem\<^sub>2
\<langle>c, mds, mem\<^sub>2\<rangle> \<leadsto>\<^sup>+ \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
\<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
is_final c\<^sub>2'
\<lbrakk>ev\<^sub>B ?mem ?b; no_await ?c\<^sub>1; \<langle>?c\<^sub>1, ?mds, ?mem\<rangle> \<leadsto>\<^sup>+ \<langle>?c\<^sub>2, ?mds', ?mem'\<rangle>; is_final ?c\<^sub>2\<rbrakk> \<Longrightarrow> \<langle>Await ?b ?c\<^sub>1, ?mds, ?mem\<rangle> \<leadsto> \<langle>?c\<^sub>2, ?mds', ?mem'\<rangle>

goal (1 subgoal):
 1. \<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>c\<^sub>2' mem\<^sub>2'. \<langle>Await e c, mds, mem\<^sub>2\<rangle> \<leadsto> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle> \<and> \<langle>c\<^sub>1', mds', mem\<^sub>1'\<rangle> \<R>\<^sup>u\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2', mds', mem\<^sub>2'\<rangle>

goal:
No subgoals!
[PROOF STEP]
qed