[STATEMENT]
lemma conf_upd_obj:
"h a = Some (C,fs) ==> (G,h(a\<mapsto>(C,fs'))\<turnstile>x::\<preceq>T) = (G,h\<turnstile>x::\<preceq>T)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h a = Some (C, fs) \<Longrightarrow> (G,h(a \<mapsto> (C, fs')) \<turnstile> x ::\<preceq> T) = (G,h \<turnstile> x ::\<preceq> T)
[PROOF STEP]
apply (unfold conf_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h a = Some (C, fs) \<Longrightarrow> (\<exists>T'. typeof (map_option obj_ty \<circ> h(a \<mapsto> (C, fs'))) x = Some T' \<and> G \<turnstile> T' \<preceq> T) = (\<exists>T'. typeof (map_option obj_ty \<circ> h) x = Some T' \<and> G \<turnstile> T' \<preceq> T)
[PROOF STEP]
apply (rule val.induct)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. h a = Some (C, fs) \<Longrightarrow> (\<exists>T'. typeof (map_option obj_ty \<circ> h(a \<mapsto> (C, fs'))) Unit = Some T' \<and> G \<turnstile> T' \<preceq> T) = (\<exists>T'. typeof (map_option obj_ty \<circ> h) Unit = Some T' \<and> G \<turnstile> T' \<preceq> T)
 2. h a = Some (C, fs) \<Longrightarrow> (\<exists>T'. typeof (map_option obj_ty \<circ> h(a \<mapsto> (C, fs'))) Null = Some T' \<and> G \<turnstile> T' \<preceq> T) = (\<exists>T'. typeof (map_option obj_ty \<circ> h) Null = Some T' \<and> G \<turnstile> T' \<preceq> T)
 3. \<And>x. h a = Some (C, fs) \<Longrightarrow> (\<exists>T'. typeof (map_option obj_ty \<circ> h(a \<mapsto> (C, fs'))) (Bool x) = Some T' \<and> G \<turnstile> T' \<preceq> T) = (\<exists>T'. typeof (map_option obj_ty \<circ> h) (Bool x) = Some T' \<and> G \<turnstile> T' \<preceq> T)
 4. \<And>x. h a = Some (C, fs) \<Longrightarrow> (\<exists>T'. typeof (map_option obj_ty \<circ> h(a \<mapsto> (C, fs'))) (Intg x) = Some T' \<and> G \<turnstile> T' \<preceq> T) = (\<exists>T'. typeof (map_option obj_ty \<circ> h) (Intg x) = Some T' \<and> G \<turnstile> T' \<preceq> T)
 5. \<And>x. h a = Some (C, fs) \<Longrightarrow> (\<exists>T'. typeof (map_option obj_ty \<circ> h(a \<mapsto> (C, fs'))) (Addr x) = Some T' \<and> G \<turnstile> T' \<preceq> T) = (\<exists>T'. typeof (map_option obj_ty \<circ> h) (Addr x) = Some T' \<and> G \<turnstile> T' \<preceq> T)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "test_uint"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. test_uint
[PROOF STEP]
quickcheck[exhaustive, expect=no_counterexample]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. test_uint
[PROOF STEP]
oops \<comment> \<open>FIXME: prove correctness of test by reflective means (not yet supported)\<close>


[STATEMENT]
lemma pr_sign_key_analz:
 "(evs, S, A, U) \<in> protocol \<Longrightarrow> Key (priSK X) \<notin> analz (A \<union> spies evs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (evs, S, A, U) \<in> protocol \<Longrightarrow> Key (priSK X) \<notin> analz (A \<union> spies evs)
[PROOF STEP]
proof (simp add: pr_key_analz, erule protocol.induct,
 auto simp add: priSK_pubSK priSK_symK)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>evsR3 S A U d n run s b a Xa c. \<lbrakk>(evsR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; Pri_AgrK d \<notin> U; NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = None; Says n run 3 Xa (Card n) (pubAK (c * (s + a * b))) \<in> set evsR3; Key (sesK (c * d * (s + a * b))) \<notin> U; d \<noteq> 0; s + a * b \<noteq> 0; Pri_AgrK c \<in> analz (A \<union> spies evsR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
 2. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
fix evsR3 S A U s a b c d
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>evsR3 S A U d n run s b a Xa c. \<lbrakk>(evsR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; Pri_AgrK d \<notin> U; NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = None; Says n run 3 Xa (Card n) (pubAK (c * (s + a * b))) \<in> set evsR3; Key (sesK (c * d * (s + a * b))) \<notin> U; d \<noteq> 0; s + a * b \<noteq> 0; Pri_AgrK c \<in> analz (A \<union> spies evsR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
 2. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "(evsR3, S, A, U) \<in> protocol"
[PROOF STATE]
proof (state)
this:
(evsR3, S, A, U) \<in> protocol

goal (2 subgoals):
 1. \<And>evsR3 S A U d n run s b a Xa c. \<lbrakk>(evsR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; Pri_AgrK d \<notin> U; NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = None; Says n run 3 Xa (Card n) (pubAK (c * (s + a * b))) \<in> set evsR3; Key (sesK (c * d * (s + a * b))) \<notin> U; d \<noteq> 0; s + a * b \<noteq> 0; Pri_AgrK c \<in> analz (A \<union> spies evsR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
 2. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
hence "Key (priSK X) \<in> U"
[PROOF STATE]
proof (prove)
using this:
(evsR3, S, A, U) \<in> protocol

goal (1 subgoal):
 1. Key (priSK X) \<in> U
[PROOF STEP]
by (rule pr_sign_key_used)
[PROOF STATE]
proof (state)
this:
Key (priSK X) \<in> U

goal (2 subgoals):
 1. \<And>evsR3 S A U d n run s b a Xa c. \<lbrakk>(evsR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; Pri_AgrK d \<notin> U; NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = None; Says n run 3 Xa (Card n) (pubAK (c * (s + a * b))) \<in> set evsR3; Key (sesK (c * d * (s + a * b))) \<notin> U; d \<noteq> 0; s + a * b \<noteq> 0; Pri_AgrK c \<in> analz (A \<union> spies evsR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
 2. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Key (priSK X) \<in> U

goal (2 subgoals):
 1. \<And>evsR3 S A U d n run s b a Xa c. \<lbrakk>(evsR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; Pri_AgrK d \<notin> U; NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = None; Says n run 3 Xa (Card n) (pubAK (c * (s + a * b))) \<in> set evsR3; Key (sesK (c * d * (s + a * b))) \<notin> U; d \<noteq> 0; s + a * b \<noteq> 0; Pri_AgrK c \<in> analz (A \<union> spies evsR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
 2. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "priSK X = sesK (c * d * (s + a * b))"
[PROOF STATE]
proof (state)
this:
priSK X = sesK (c * d * (s + a * b))

goal (2 subgoals):
 1. \<And>evsR3 S A U d n run s b a Xa c. \<lbrakk>(evsR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; Pri_AgrK d \<notin> U; NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = None; Says n run 3 Xa (Card n) (pubAK (c * (s + a * b))) \<in> set evsR3; Key (sesK (c * d * (s + a * b))) \<notin> U; d \<noteq> 0; s + a * b \<noteq> 0; Pri_AgrK c \<in> analz (A \<union> spies evsR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
 2. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Key (priSK X) \<in> U
priSK X = sesK (c * d * (s + a * b))
[PROOF STEP]
have "Key (sesK (c * d * (s + a * b))) \<in> U"
[PROOF STATE]
proof (prove)
using this:
Key (priSK X) \<in> U
priSK X = sesK (c * d * (s + a * b))

goal (1 subgoal):
 1. Key (sesK (c * d * (s + a * b))) \<in> U
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Key (sesK (c * d * (s + a * b))) \<in> U

goal (2 subgoals):
 1. \<And>evsR3 S A U d n run s b a Xa c. \<lbrakk>(evsR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; Pri_AgrK d \<notin> U; NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = None; Says n run 3 Xa (Card n) (pubAK (c * (s + a * b))) \<in> set evsR3; Key (sesK (c * d * (s + a * b))) \<notin> U; d \<noteq> 0; s + a * b \<noteq> 0; Pri_AgrK c \<in> analz (A \<union> spies evsR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
 2. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Key (sesK (c * d * (s + a * b))) \<in> U

goal (2 subgoals):
 1. \<And>evsR3 S A U d n run s b a Xa c. \<lbrakk>(evsR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; Pri_AgrK d \<notin> U; NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = None; Says n run 3 Xa (Card n) (pubAK (c * (s + a * b))) \<in> set evsR3; Key (sesK (c * d * (s + a * b))) \<notin> U; d \<noteq> 0; s + a * b \<noteq> 0; Pri_AgrK c \<in> analz (A \<union> spies evsR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
 2. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "Key (sesK (c * d * (s + a * b))) \<notin> U"
[PROOF STATE]
proof (state)
this:
Key (sesK (c * d * (s + a * b))) \<notin> U

goal (2 subgoals):
 1. \<And>evsR3 S A U d n run s b a Xa c. \<lbrakk>(evsR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; Pri_AgrK d \<notin> U; NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = None; Says n run 3 Xa (Card n) (pubAK (c * (s + a * b))) \<in> set evsR3; Key (sesK (c * d * (s + a * b))) \<notin> U; d \<noteq> 0; s + a * b \<noteq> 0; Pri_AgrK c \<in> analz (A \<union> spies evsR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
 2. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Key (sesK (c * d * (s + a * b))) \<in> U
Key (sesK (c * d * (s + a * b))) \<notin> U
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
Key (sesK (c * d * (s + a * b))) \<in> U
Key (sesK (c * d * (s + a * b))) \<notin> U

goal (1 subgoal):
 1. False
[PROOF STEP]
by contradiction
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
fix evsFR3 S A U s a b c d
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "(evsFR3, S, A, U) \<in> protocol"
[PROOF STATE]
proof (state)
this:
(evsFR3, S, A, U) \<in> protocol

goal (1 subgoal):
 1. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
hence "Key (priSK X) \<in> U"
[PROOF STATE]
proof (prove)
using this:
(evsFR3, S, A, U) \<in> protocol

goal (1 subgoal):
 1. Key (priSK X) \<in> U
[PROOF STEP]
by (rule pr_sign_key_used)
[PROOF STATE]
proof (state)
this:
Key (priSK X) \<in> U

goal (1 subgoal):
 1. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Key (priSK X) \<in> U

goal (1 subgoal):
 1. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "priSK X = sesK (c * d * (s + a * b))"
[PROOF STATE]
proof (state)
this:
priSK X = sesK (c * d * (s + a * b))

goal (1 subgoal):
 1. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Key (priSK X) \<in> U
priSK X = sesK (c * d * (s + a * b))
[PROOF STEP]
have "Key (sesK (c * d * (s + a * b))) \<in> U"
[PROOF STATE]
proof (prove)
using this:
Key (priSK X) \<in> U
priSK X = sesK (c * d * (s + a * b))

goal (1 subgoal):
 1. Key (sesK (c * d * (s + a * b))) \<in> U
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Key (sesK (c * d * (s + a * b))) \<in> U

goal (1 subgoal):
 1. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Key (sesK (c * d * (s + a * b))) \<in> U

goal (1 subgoal):
 1. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume "Key (sesK (c * d * (s + a * b))) \<notin> U"
[PROOF STATE]
proof (state)
this:
Key (sesK (c * d * (s + a * b))) \<notin> U

goal (1 subgoal):
 1. \<And>evsFR3 S A U m n run s a b c d. \<lbrakk>(evsFR3, S, A, U) \<in> protocol; Key (sesK (c * d * (s + a * b))) \<notin> A; 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; Key (sesK (c * d * (s + a * b))) \<notin> U; Pri_AgrK s \<in> analz (A \<union> spies evsFR3); Pri_AgrK b \<in> analz (A \<union> spies evsFR3); Pri_AgrK d \<in> analz (A \<union> spies evsFR3); priSK X = sesK (c * d * (s + a * b))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Key (sesK (c * d * (s + a * b))) \<in> U
Key (sesK (c * d * (s + a * b))) \<notin> U
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
Key (sesK (c * d * (s + a * b))) \<in> U
Key (sesK (c * d * (s + a * b))) \<notin> U

goal (1 subgoal):
 1. False
[PROOF STEP]
by contradiction
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_tag_name_type_wf_preserved [simp]:
  "h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> CharacterDataClass.type_wf h = CharacterDataClass.type_wf h'
[PROOF STEP]
apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
      dest!: get_heap_E
      elim!: bind_returns_heap_E2
      intro!: type_wf_put_I ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I
      ObjectMonad.type_wf_put_I)[1]
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ElementClass.type_wf h
 2. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> NodeClass.type_wf h
 3. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 4. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> is_node_kind (cast (cast (x\<lparr>tag_name := v\<rparr>)))
 5. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> CharacterDataClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> NodeClass.type_wf h
 2. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 3. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> is_node_kind (cast (cast (x\<lparr>tag_name := v\<rparr>)))
 4. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> CharacterDataClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 2. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> is_node_kind (cast (cast (x\<lparr>tag_name := v\<rparr>)))
 3. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> CharacterDataClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> is_node_kind (cast (cast (x\<lparr>tag_name := v\<rparr>)))
 2. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> CharacterDataClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> CharacterDataClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 2. \<And>x node_ptr. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; node_ptr |\<in>| node_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get node_ptr h = Some y
 3. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
using ObjectMonad.type_wf_put_ptr_in_heap_E ObjectMonad.type_wf_put_ptr_not_in_heap_E
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>ObjectClass.type_wf (put ?ptr ?obj ?h); ?ptr |\<in>| object_ptr_kinds ?h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf ?h
\<lbrakk>ObjectClass.type_wf (put ?ptr ?obj ?h); ?ptr |\<notin>| object_ptr_kinds ?h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf ?h

goal (3 subgoals):
 1. \<And>x. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 2. \<And>x node_ptr. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; node_ptr |\<in>| node_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get node_ptr h = Some y
 3. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x node_ptr. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; node_ptr |\<in>| node_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get node_ptr h = Some y
 2. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
apply (metis (no_types, lifting) bind_eq_Some_conv finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
apply (metis finite_set_in)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma servTicket_form:
     "\<lbrakk> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace>
              \<in> parts (spies evs);
            Key authK \<notin> analz (spies evs);
            evs \<in> kerbIV \<rbrakk>
         \<Longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and>
    (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs); Key authK \<notin> analz (knows Spy evs); evs \<in> kerbIV\<rbrakk> \<Longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Key authK \<notin> analz (knows Spy evs); evs \<in> kerbIV\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. evs \<in> kerbIV \<Longrightarrow> Key authK \<notin> analz (knows Spy evs) \<longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
[PROOF STEP]
apply (erule kerbIV.induct, analz_mono_contra)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. Key authK \<notin> analz (knows Spy []) \<longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy []) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 2. \<And>evsf X Ba. \<lbrakk>evsf \<in> kerbIV; X \<in> synth (analz (knows Spy evsf)); Key authK \<notin> analz (knows Spy evsf); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Spy Ba X # evsf)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 3. \<And>evs1 A. \<lbrakk>evs1 \<in> kerbIV; Key authK \<notin> analz (knows Spy evs1); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 4. \<And>evs2 authKa A' A T1. \<lbrakk>evs2 \<in> kerbIV; Key authKa \<notin> used evs2; authKa \<in> symKeys; Says A' Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs2; Key authK \<notin> analz (knows Spy evs2); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Kas A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number (CT evs2), Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number (CT evs2)\<rbrace>\<rbrace>) # evs2)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 5. \<And>evs3 A T1 Kas' authKa Ta authTicket Ba. \<lbrakk>evs3 \<in> kerbIV; Says A Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs3; Says Kas' A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evs3; valid Ta wrt T1; Key authK \<notin> analz (knows Spy evs3); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Tgs \<lbrace>authTicket, Crypt authKa \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent Ba\<rbrace> # evs3)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 6. \<And>evs4 servKa Ba authKa A' A Ta T2. \<lbrakk>evs4 \<in> kerbIV; Key servKa \<notin> used evs4; servKa \<in> symKeys; Ba \<noteq> Tgs; authKa \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number Ta\<rbrace>, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredAK Ta evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key authK \<notin> analz (knows Spy evs4); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Tgs A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace>\<rbrace>) # evs4)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 7. \<And>evs5 authKa servKa A authTicket T2 Ba Tgs' Tsa servTicketa. \<lbrakk>evs5 \<in> kerbIV; authKa \<in> symKeys; servKa \<in> symKeys; Says A Tgs \<lbrace>authTicket, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs5; Says Tgs' A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number Tsa, servTicketa\<rbrace>) \<in> set evs5; valid Tsa wrt T2; Key authK \<notin> analz (knows Spy evs5); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs5) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Ba \<lbrace>servTicketa, Crypt servKa \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 8. \<And>evs6 A' Ba A servKa Tsa T3. \<lbrakk>evs6 \<in> kerbIV; Says A' Ba \<lbrace>Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number Tsa\<rbrace>, Crypt servKa \<lbrace>Agent A, Number T3\<rbrace>\<rbrace> \<in> set evs6; \<not> expiredSK Tsa evs6; \<not> expiredA T3 evs6; Key authK \<notin> analz (knows Spy evs6); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs6) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Ba A (Crypt servKa (Number T3)) # evs6)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 9. \<And>evsO1 A authKa Ta authTicket. \<lbrakk>evsO1 \<in> kerbIV; A \<noteq> Spy; Says Kas A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evsO1; expiredAK Ta evsO1; Key authK \<notin> analz (knows Spy evsO1); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evsO1) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authKa\<rbrace> # evsO1)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 10. \<And>evsO2 A authKa servKa Ba Tsa servTicketa. \<lbrakk>evsO2 \<in> kerbIV; A \<noteq> Spy; Says Tgs A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number Tsa, servTicketa\<rbrace>) \<in> set evsO2; expiredSK Tsa evsO2; Key authK \<notin> analz (knows Spy evsO2); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evsO2) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Ba, Number Tsa, Key servKa\<rbrace> # evsO2)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
[PROOF STEP]
apply (frule_tac [7] K5_msg_in_parts_spies)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. Key authK \<notin> analz (knows Spy []) \<longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy []) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 2. \<And>evsf X Ba. \<lbrakk>evsf \<in> kerbIV; X \<in> synth (analz (knows Spy evsf)); Key authK \<notin> analz (knows Spy evsf); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Spy Ba X # evsf)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 3. \<And>evs1 A. \<lbrakk>evs1 \<in> kerbIV; Key authK \<notin> analz (knows Spy evs1); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 4. \<And>evs2 authKa A' A T1. \<lbrakk>evs2 \<in> kerbIV; Key authKa \<notin> used evs2; authKa \<in> symKeys; Says A' Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs2; Key authK \<notin> analz (knows Spy evs2); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Kas A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number (CT evs2), Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number (CT evs2)\<rbrace>\<rbrace>) # evs2)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 5. \<And>evs3 A T1 Kas' authKa Ta authTicket Ba. \<lbrakk>evs3 \<in> kerbIV; Says A Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs3; Says Kas' A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evs3; valid Ta wrt T1; Key authK \<notin> analz (knows Spy evs3); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Tgs \<lbrace>authTicket, Crypt authKa \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent Ba\<rbrace> # evs3)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 6. \<And>evs4 servKa Ba authKa A' A Ta T2. \<lbrakk>evs4 \<in> kerbIV; Key servKa \<notin> used evs4; servKa \<in> symKeys; Ba \<noteq> Tgs; authKa \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number Ta\<rbrace>, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredAK Ta evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key authK \<notin> analz (knows Spy evs4); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Tgs A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace>\<rbrace>) # evs4)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 7. \<And>evs5 authKa servKa A authTicket T2 Ba Tgs' Tsa servTicketa. \<lbrakk>evs5 \<in> kerbIV; authKa \<in> symKeys; servKa \<in> symKeys; Says A Tgs \<lbrace>authTicket, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs5; Says Tgs' A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number Tsa, servTicketa\<rbrace>) \<in> set evs5; valid Tsa wrt T2; Key authK \<notin> analz (knows Spy evs5); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs5) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>); servTicketa \<in> parts (knows Spy evs5)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Ba \<lbrace>servTicketa, Crypt servKa \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 8. \<And>evs6 A' Ba A servKa Tsa T3. \<lbrakk>evs6 \<in> kerbIV; Says A' Ba \<lbrace>Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number Tsa\<rbrace>, Crypt servKa \<lbrace>Agent A, Number T3\<rbrace>\<rbrace> \<in> set evs6; \<not> expiredSK Tsa evs6; \<not> expiredA T3 evs6; Key authK \<notin> analz (knows Spy evs6); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evs6) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Ba A (Crypt servKa (Number T3)) # evs6)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 9. \<And>evsO1 A authKa Ta authTicket. \<lbrakk>evsO1 \<in> kerbIV; A \<noteq> Spy; Says Kas A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evsO1; expiredAK Ta evsO1; Key authK \<notin> analz (knows Spy evsO1); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evsO1) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authKa\<rbrace> # evsO1)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
 10. \<And>evsO2 A authKa servKa Ba Tsa servTicketa. \<lbrakk>evsO2 \<in> kerbIV; A \<noteq> Spy; Says Tgs A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number Tsa, servTicketa\<rbrace>) \<in> set evsO2; expiredSK Tsa evsO2; Key authK \<notin> analz (knows Spy evsO2); Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy evsO2) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Ba, Number Tsa, Key servKa\<rbrace> # evsO2)) \<longrightarrow> servK \<notin> range shrK \<and> servK \<in> symKeys \<and> (\<exists>A. servTicket = Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Ts\<rbrace>)
[PROOF STEP]
apply (frule_tac [5] K3_msg_in_parts_spies, simp_all, blast)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma \<alpha>\<^sub>t\<^sub>i_covers_\<alpha>\<^sub>0_ik:
  assumes \_reach: "\ \<in> reachable_constraints P"
    and T: "T \<in> set P"
    and \: "welltyped_constraint_model \ (\@dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))"
    and \<xi>: "transaction_decl_subst \<xi> T"
    and \<sigma>: "transaction_fresh_subst \<sigma> T \"
    and \<alpha>: "transaction_renaming_subst \<alpha> P \"
    and P: "\<forall>T \<in> set P. admissible_transaction T"
    and t: "t \<in> ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \"
  shows "t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\@dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in>
            timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
define a0 where "a0 \<equiv> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)"
[PROOF STATE]
proof (state)
this:
a0 \<equiv> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)

goal (1 subgoal):
 1. t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
define a0' where "a0' \<equiv> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\@dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \)"
[PROOF STATE]
proof (state)
this:
a0' \<equiv> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \)

goal (1 subgoal):
 1. t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
define a3 where "a3 \<equiv> \<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \"
[PROOF STATE]
proof (state)
this:
a3 \<equiv> \<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \

goal (1 subgoal):
 1. t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
let ?U = "\<lambda>T a. map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a) T"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
have \_wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s: "wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \)
[PROOF STEP]
by (metis reachable_constraints_wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s admissible_transactions_wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s P(1) \_reach)
[PROOF STATE]
proof (state)
this:
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \)

goal (1 subgoal):
 1. t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
have T_adm: "admissible_transaction T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. admissible_transaction T
[PROOF STEP]
by (metis P(1) T)
[PROOF STATE]
proof (state)
this:
admissible_transaction T

goal (1 subgoal):
 1. t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
have "t \<in> subterms\<^sub>s\<^sub>e\<^sub>t (ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \)" "wf\<^sub>t\<^sub>r\<^sub>m t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ &&& wf\<^sub>t\<^sub>r\<^sub>m t
[PROOF STEP]
using \_wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s t ik\<^sub>s\<^sub>s\<^sub>t_trms\<^sub>s\<^sub>s\<^sub>t_subset
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \)
t \<in> ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
ik\<^sub>s\<^sub>s\<^sub>t ?A \<subseteq> trms\<^sub>s\<^sub>s\<^sub>t ?A

goal (1 subgoal):
 1. t \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ &&& wf\<^sub>t\<^sub>r\<^sub>m t
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
t \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
wf\<^sub>t\<^sub>r\<^sub>m t

goal (1 subgoal):
 1. t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
hence "\<forall>t0 \<in> subterms t. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3"
[PROOF STATE]
proof (prove)
using this:
t \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
wf\<^sub>t\<^sub>r\<^sub>m t

goal (1 subgoal):
 1. \<forall>t0\<in>subterms t. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
proof (induction t)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>Var x \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Var x)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Var x). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
 2. \<And>x1a x2. \<lbrakk>\<And>x2a. \<lbrakk>x2a \<in> set x2; x2a \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m x2a\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms x2a. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3; Fun x1a x2 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Fun x1a x2)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Fun x1a x2). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
case (Var x)
[PROOF STATE]
proof (state)
this:
Var x \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
wf\<^sub>t\<^sub>r\<^sub>m (Var x)

goal (2 subgoals):
 1. \<And>x. \<lbrakk>Var x \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Var x)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Var x). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
 2. \<And>x1a x2. \<lbrakk>\<And>x2a. \<lbrakk>x2a \<in> set x2; x2a \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m x2a\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms x2a. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3; Fun x1a x2 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Fun x1a x2)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Fun x1a x2). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
Var x \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
wf\<^sub>t\<^sub>r\<^sub>m (Var x)

goal (1 subgoal):
 1. \<forall>t0\<in>subterms (Var x). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
using \<alpha>\<^sub>t\<^sub>i_covers_\<alpha>\<^sub>0_Var[OF \_reach T \ \<xi> \<sigma> \<alpha> P, of x]
            ik\<^sub>s\<^sub>s\<^sub>t_var_is_fv[of x "unlabel \"] vars\<^sub>s\<^sub>s\<^sub>t_is_fv\<^sub>s\<^sub>s\<^sub>t_bvars\<^sub>s\<^sub>s\<^sub>t[of "unlabel \"]
[PROOF STATE]
proof (prove)
using this:
Var x \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
wf\<^sub>t\<^sub>r\<^sub>m (Var x)
x \<in> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
Var x \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<Longrightarrow> x \<in> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<union> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \

goal (1 subgoal):
 1. \<forall>t0\<in>subterms (Var x). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
by (simp add: a0_def a0'_def a3_def)
[PROOF STATE]
proof (state)
this:
\<forall>t0\<in>subterms (Var x). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \<And>x1a x2. \<lbrakk>\<And>x2a. \<lbrakk>x2a \<in> set x2; x2a \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m x2a\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms x2a. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3; Fun x1a x2 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Fun x1a x2)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Fun x1a x2). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x1a x2. \<lbrakk>\<And>x2a. \<lbrakk>x2a \<in> set x2; x2a \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m x2a\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms x2a. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3; Fun x1a x2 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Fun x1a x2)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Fun x1a x2). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
case (Fun f S)
[PROOF STATE]
proof (state)
this:
\<lbrakk>?x2a50 \<in> set S; ?x2a50 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m ?x2a50\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms ?x2a50. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
Fun f S \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
wf\<^sub>t\<^sub>r\<^sub>m (Fun f S)

goal (1 subgoal):
 1. \<And>x1a x2. \<lbrakk>\<And>x2a. \<lbrakk>x2a \<in> set x2; x2a \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m x2a\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms x2a. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3; Fun x1a x2 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Fun x1a x2)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Fun x1a x2). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
have IH: "\<forall>t0 \<in> subterms t. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3"
      when "t \<in> set S" for t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>t0\<in>subterms t. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
using that Fun.prems(1) wf_trm_param[OF Fun.prems(2)] Fun.IH
[PROOF STATE]
proof (prove)
using this:
t \<in> set S
Fun f S \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
?t \<in> set S \<Longrightarrow> wf\<^sub>t\<^sub>r\<^sub>m ?t
\<lbrakk>?x2a50 \<in> set S; ?x2a50 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m ?x2a50\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms ?x2a50. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \<forall>t0\<in>subterms t. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
by (meson in_subterms_subset_Union params_subterms subsetCE)
[PROOF STATE]
proof (state)
this:
?t50 \<in> set S \<Longrightarrow> \<forall>t0\<in>subterms ?t50. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \<And>x1a x2. \<lbrakk>\<And>x2a. \<lbrakk>x2a \<in> set x2; x2a \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m x2a\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms x2a. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3; Fun x1a x2 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Fun x1a x2)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Fun x1a x2). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
hence "t \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t \<cdot>\<^sub>\<alpha> a0} a3"
      when "t \<in> set (map (\<lambda>s. s \<cdot> \) S)" for t
[PROOF STATE]
proof (prove)
using this:
?t50 \<in> set S \<Longrightarrow> \<forall>t0\<in>subterms ?t50. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. t \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
?t50 \<in> set S \<Longrightarrow> \<forall>t0\<in>subterms ?t50. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
t \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \)

goal (1 subgoal):
 1. t \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?t50 \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \) \<Longrightarrow> ?t50 \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {?t50 \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \<And>x1a x2. \<lbrakk>\<And>x2a. \<lbrakk>x2a \<in> set x2; x2a \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m x2a\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms x2a. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3; Fun x1a x2 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Fun x1a x2)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Fun x1a x2). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
hence "t \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure (t \<cdot>\<^sub>\<alpha> a0) a3"
      when "t \<in> set (map (\<lambda>s. s \<cdot> \) S)" for t
[PROOF STATE]
proof (prove)
using this:
?t50 \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \) \<Longrightarrow> ?t50 \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {?t50 \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. t \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure (t \<cdot>\<^sub>\<alpha> a0) a3
[PROOF STEP]
using that timpl_closureton_is_timpl_closure
[PROOF STATE]
proof (prove)
using this:
?t50 \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \) \<Longrightarrow> ?t50 \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {?t50 \<cdot>\<^sub>\<alpha> a0} a3
t \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \)
timpl_closure_set {?t} ?TI = timpl_closure ?t ?TI

goal (1 subgoal):
 1. t \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure (t \<cdot>\<^sub>\<alpha> a0) a3
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?t50 \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \) \<Longrightarrow> ?t50 \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure (?t50 \<cdot>\<^sub>\<alpha> a0) a3

goal (1 subgoal):
 1. \<And>x1a x2. \<lbrakk>\<And>x2a. \<lbrakk>x2a \<in> set x2; x2a \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m x2a\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms x2a. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3; Fun x1a x2 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Fun x1a x2)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Fun x1a x2). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
hence "(t \<cdot>\<^sub>\<alpha> a0, t \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3"
      when "t \<in> set (map (\<lambda>s. s \<cdot> \) S)" for t
[PROOF STATE]
proof (prove)
using this:
?t50 \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \) \<Longrightarrow> ?t50 \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure (?t50 \<cdot>\<^sub>\<alpha> a0) a3

goal (1 subgoal):
 1. (t \<cdot>\<^sub>\<alpha> a0, t \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3
[PROOF STEP]
using that timpl_closure_is_timpl_closure'
[PROOF STATE]
proof (prove)
using this:
?t50 \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \) \<Longrightarrow> ?t50 \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure (?t50 \<cdot>\<^sub>\<alpha> a0) a3
t \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \)
(?s \<in> timpl_closure ?t ?TI) = ((?t, ?s) \<in> timpl_closure' ?TI)

goal (1 subgoal):
 1. (t \<cdot>\<^sub>\<alpha> a0, t \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?t50 \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \) \<Longrightarrow> (?t50 \<cdot>\<^sub>\<alpha> a0, ?t50 \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3

goal (1 subgoal):
 1. \<And>x1a x2. \<lbrakk>\<And>x2a. \<lbrakk>x2a \<in> set x2; x2a \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m x2a\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms x2a. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3; Fun x1a x2 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Fun x1a x2)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Fun x1a x2). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
hence IH': "((?U S a0) ! i, (?U S a0') ! i) \<in> timpl_closure' a3"
      when "i < length (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0) S)" for i
[PROOF STATE]
proof (prove)
using this:
?t50 \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \) \<Longrightarrow> (?t50 \<cdot>\<^sub>\<alpha> a0, ?t50 \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3

goal (1 subgoal):
 1. (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0) S ! i, map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0') S ! i) \<in> timpl_closure' a3
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
?t50 \<in> set (S \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \) \<Longrightarrow> (?t50 \<cdot>\<^sub>\<alpha> a0, ?t50 \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3
i < length (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0) S)

goal (1 subgoal):
 1. (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0) S ! i, map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0') S ! i) \<in> timpl_closure' a3
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?i50 < length (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0) S) \<Longrightarrow> (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0) S ! ?i50, map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0') S ! ?i50) \<in> timpl_closure' a3

goal (1 subgoal):
 1. \<And>x1a x2. \<lbrakk>\<And>x2a. \<lbrakk>x2a \<in> set x2; x2a \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m x2a\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms x2a. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3; Fun x1a x2 \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \; wf\<^sub>t\<^sub>r\<^sub>m (Fun x1a x2)\<rbrakk> \<Longrightarrow> \<forall>t0\<in>subterms (Fun x1a x2). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
proof (cases "\<exists>n. f = Val n")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<exists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
 2. \<nexists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<exists>n. f = Val n

goal (2 subgoals):
 1. \<exists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
 2. \<nexists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>n. f = Val n
[PROOF STEP]
obtain n where "Fun f S = Fun (Val n) []"
[PROOF STATE]
proof (prove)
using this:
\<exists>n. f = Val n

goal (1 subgoal):
 1. (\<And>n. Fun f S = Fun (Val n) [] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using Fun.prems(2)
[PROOF STATE]
proof (prove)
using this:
\<exists>n. f = Val n
wf\<^sub>t\<^sub>r\<^sub>m (Fun f S)

goal (1 subgoal):
 1. (\<And>n. Fun f S = Fun (Val n) [] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding wf\<^sub>t\<^sub>r\<^sub>m_def
[PROOF STATE]
proof (prove)
using this:
\<exists>n. f = Val n
\<forall>fa T. Fun fa T \<sqsubseteq> Fun f S \<longrightarrow> length T = arity fa

goal (1 subgoal):
 1. (\<And>n. Fun f S = Fun (Val n) [] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
Fun f S = Fun (Val n) []

goal (2 subgoals):
 1. \<exists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
 2. \<nexists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Fun f S = Fun (Val n) []

goal (2 subgoals):
 1. \<exists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
 2. \<nexists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
have "Fun f S \<in> subterms\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Fun f S \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
[PROOF STEP]
using ik\<^sub>s\<^sub>s\<^sub>t_trms\<^sub>s\<^sub>s\<^sub>t_subset Fun.prems(1)
[PROOF STATE]
proof (prove)
using this:
ik\<^sub>s\<^sub>s\<^sub>t ?A \<subseteq> trms\<^sub>s\<^sub>s\<^sub>t ?A
Fun f S \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t \

goal (1 subgoal):
 1. Fun f S \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Fun f S \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \

goal (2 subgoals):
 1. \<exists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
 2. \<nexists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Fun f S = Fun (Val n) []
Fun f S \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
Fun f S = Fun (Val n) []
Fun f S \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \

goal (1 subgoal):
 1. \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
using \<alpha>\<^sub>t\<^sub>i_covers_\<alpha>\<^sub>0_Val[OF \_reach T \ \<xi> \<sigma> \<alpha> P]
[PROOF STATE]
proof (prove)
using this:
Fun f S = Fun (Val n) []
Fun f S \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
Fun (Val ?n) [] \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<Longrightarrow> Fun (Val ?n) [] \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {Fun (Val ?n) [] \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)

goal (1 subgoal):
 1. \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
by (simp add: a0_def a0'_def a3_def)
[PROOF STATE]
proof (state)
this:
\<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \<nexists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<nexists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<nexists>n. f = Val n

goal (1 subgoal):
 1. \<nexists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
hence "Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a = Fun f (map (\<lambda>t. t \<cdot> \ \<cdot>\<^sub>\<alpha> a) S)" for a
[PROOF STATE]
proof (prove)
using this:
\<nexists>n. f = Val n

goal (1 subgoal):
 1. Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a = Fun f (map (\<lambda>t. t \<cdot> \ \<cdot>\<^sub>\<alpha> a) S)
[PROOF STEP]
by (cases f) simp_all
[PROOF STATE]
proof (state)
this:
Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> ?a50 = Fun f (map (\<lambda>t. t \<cdot> \ \<cdot>\<^sub>\<alpha> ?a50) S)

goal (1 subgoal):
 1. \<nexists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
hence "(Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0, Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3"
[PROOF STATE]
proof (prove)
using this:
Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> ?a50 = Fun f (map (\<lambda>t. t \<cdot> \ \<cdot>\<^sub>\<alpha> ?a50) S)

goal (1 subgoal):
 1. (Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0, Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3
[PROOF STEP]
using timpl_closure_FunI[OF IH']
[PROOF STATE]
proof (prove)
using this:
Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> ?a50 = Fun f (map (\<lambda>t. t \<cdot> \ \<cdot>\<^sub>\<alpha> ?a50) S)
\<lbrakk>\<And>i. i < length (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0) S) \<Longrightarrow> i < length (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0) S); length (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0) S) = length (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0') S); ?f = ?g \<or> (\<exists>a b. (a, b) \<in> a3\<^sup>+ \<and> ?f = Abs a \<and> ?g = Abs b)\<rbrakk> \<Longrightarrow> (Fun ?f (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0) S), Fun ?g (map (\<lambda>s. s \<cdot> \ \<cdot>\<^sub>\<alpha> a0') S)) \<in> timpl_closure' a3

goal (1 subgoal):
 1. (Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0, Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0, Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3

goal (1 subgoal):
 1. \<nexists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
hence "Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3"
[PROOF STATE]
proof (prove)
using this:
(Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0, Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3

goal (1 subgoal):
 1. Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
using timpl_closureton_is_timpl_closure
              timpl_closure_is_timpl_closure'
[PROOF STATE]
proof (prove)
using this:
(Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0, Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0') \<in> timpl_closure' a3
timpl_closure_set {?t} ?TI = timpl_closure ?t ?TI
(?s \<in> timpl_closure ?t ?TI) = ((?t, ?s) \<in> timpl_closure' ?TI)

goal (1 subgoal):
 1. Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \<nexists>n. f = Val n \<Longrightarrow> \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
using IH
[PROOF STATE]
proof (prove)
using this:
Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {Fun f S \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
?t50 \<in> set S \<Longrightarrow> \<forall>t0\<in>subterms ?t50. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>t0\<in>subterms (Fun f S). t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>t0\<in>subterms t. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<forall>t0\<in>subterms t. t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {t0 \<cdot> \ \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
by (simp add: a0_def a0'_def a3_def)
[PROOF STATE]
proof (state)
this:
t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {t \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "P \<longrightarrow> Q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<longrightarrow> Q
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<longrightarrow> Q
[PROOF STEP]
oops