[STATEMENT]
lemma pr_sign_parts [rule_format]:
 "(evs, S, A, U) \<in> protocol \<Longrightarrow>
    Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evs) \<longrightarrow>
  (\<exists>n. g = priAK n)"
  (is "_ \<Longrightarrow> ?M g \<in> _ \<longrightarrow> _")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (evs, S, A, U) \<in> protocol \<Longrightarrow> Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evs) \<longrightarrow> (\<exists>n. g = priAK n)
[PROOF STEP]
proof (erule protocol.induct, subst parts_simp, (simp, blast)+, simp_all add:
 parts_simp_insert parts_auth_data parts_crypt parts_mpair, rule_tac [!] impI)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>evsR4 S A U n run s b a d e X. \<lbrakk>(evsR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsR4) \<longrightarrow> (\<exists>n. g = priAK n); NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = Some d; ExtAgrK (S (Card n, n, run)) = Some e; Says n run 4 X (Card n) (Crypt (sesK (d * e)) (pubAK (d * (s + a * b)))) \<in> set evsR4; agrK g = agrK (priAK n)\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
 2. \<And>evsFR4 S A U m n run s a b c f ga. \<lbrakk>(evsFR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n); 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; ExtAgrK (S (User m, n, run)) = Some f; Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data ga b, pubAK ga, Crypt (priSK CA) (Hash (pubAK ga))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)); agrK g = agrK ga\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
[PROOF STEP]
fix evsR4 n
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>evsR4 S A U n run s b a d e X. \<lbrakk>(evsR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsR4) \<longrightarrow> (\<exists>n. g = priAK n); NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = Some d; ExtAgrK (S (Card n, n, run)) = Some e; Says n run 4 X (Card n) (Crypt (sesK (d * e)) (pubAK (d * (s + a * b)))) \<in> set evsR4; agrK g = agrK (priAK n)\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
 2. \<And>evsFR4 S A U m n run s a b c f ga. \<lbrakk>(evsFR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n); 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; ExtAgrK (S (User m, n, run)) = Some f; Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data ga b, pubAK ga, Crypt (priSK CA) (Hash (pubAK ga))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)); agrK g = agrK ga\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
[PROOF STEP]
assume "agrK g = agrK (priAK n)"
[PROOF STATE]
proof (state)
this:
agrK g = agrK (priAK n)

goal (2 subgoals):
 1. \<And>evsR4 S A U n run s b a d e X. \<lbrakk>(evsR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsR4) \<longrightarrow> (\<exists>n. g = priAK n); NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = Some d; ExtAgrK (S (Card n, n, run)) = Some e; Says n run 4 X (Card n) (Crypt (sesK (d * e)) (pubAK (d * (s + a * b)))) \<in> set evsR4; agrK g = agrK (priAK n)\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
 2. \<And>evsFR4 S A U m n run s a b c f ga. \<lbrakk>(evsFR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n); 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; ExtAgrK (S (User m, n, run)) = Some f; Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data ga b, pubAK ga, Crypt (priSK CA) (Hash (pubAK ga))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)); agrK g = agrK ga\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
[PROOF STEP]
with agrK_inj
[PROOF STATE]
proof (chain)
picking this:
inj agrK
agrK g = agrK (priAK n)
[PROOF STEP]
have "g = priAK n"
[PROOF STATE]
proof (prove)
using this:
inj agrK
agrK g = agrK (priAK n)

goal (1 subgoal):
 1. g = priAK n
[PROOF STEP]
by (rule injD)
[PROOF STATE]
proof (state)
this:
g = priAK n

goal (2 subgoals):
 1. \<And>evsR4 S A U n run s b a d e X. \<lbrakk>(evsR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsR4) \<longrightarrow> (\<exists>n. g = priAK n); NonceS (S (Card n, n, run)) = Some s; IntMapK (S (Card n, n, run)) = Some b; ExtMapK (S (Card n, n, run)) = Some a; IntAgrK (S (Card n, n, run)) = Some d; ExtAgrK (S (Card n, n, run)) = Some e; Says n run 4 X (Card n) (Crypt (sesK (d * e)) (pubAK (d * (s + a * b)))) \<in> set evsR4; agrK g = agrK (priAK n)\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
 2. \<And>evsFR4 S A U m n run s a b c f ga. \<lbrakk>(evsFR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n); 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; ExtAgrK (S (User m, n, run)) = Some f; Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data ga b, pubAK ga, Crypt (priSK CA) (Hash (pubAK ga))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)); agrK g = agrK ga\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
[PROOF STEP]
thus "\<exists>n. g = priAK n"
[PROOF STATE]
proof (prove)
using this:
g = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<exists>n. g = priAK n

goal (1 subgoal):
 1. \<And>evsFR4 S A U m n run s a b c f ga. \<lbrakk>(evsFR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n); 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; ExtAgrK (S (User m, n, run)) = Some f; Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data ga b, pubAK ga, Crypt (priSK CA) (Hash (pubAK ga))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)); agrK g = agrK ga\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>evsFR4 S A U m n run s a b c f ga. \<lbrakk>(evsFR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n); 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; ExtAgrK (S (User m, n, run)) = Some f; Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data ga b, pubAK ga, Crypt (priSK CA) (Hash (pubAK ga))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)); agrK g = agrK ga\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
[PROOF STEP]
fix evsFR4 S A U s a b c f g'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>evsFR4 S A U m n run s a b c f ga. \<lbrakk>(evsFR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n); 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; ExtAgrK (S (User m, n, run)) = Some f; Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data ga b, pubAK ga, Crypt (priSK CA) (Hash (pubAK ga))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)); agrK g = agrK ga\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
[PROOF STEP]
assume
    A: "?M g \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n)" and
    B: "(evsFR4, S, A, U) \<in> protocol" and
    C: "Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b,
      pubAK g', ?M g'\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))"
      (is "?M' \<in> synth (analz ?A)")
[PROOF STATE]
proof (state)
this:
Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n)
(evsFR4, S, A, U) \<in> protocol
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))

goal (1 subgoal):
 1. \<And>evsFR4 S A U m n run s a b c f ga. \<lbrakk>(evsFR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n); 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; ExtAgrK (S (User m, n, run)) = Some f; Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data ga b, pubAK ga, Crypt (priSK CA) (Hash (pubAK ga))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)); agrK g = agrK ga\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
[PROOF STEP]
assume "agrK g = agrK g'"
[PROOF STATE]
proof (state)
this:
agrK g = agrK g'

goal (1 subgoal):
 1. \<And>evsFR4 S A U m n run s a b c f ga. \<lbrakk>(evsFR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n); 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; ExtAgrK (S (User m, n, run)) = Some f; Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data ga b, pubAK ga, Crypt (priSK CA) (Hash (pubAK ga))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)); agrK g = agrK ga\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
[PROOF STEP]
with agrK_inj
[PROOF STATE]
proof (chain)
picking this:
inj agrK
agrK g = agrK g'
[PROOF STEP]
have D: "g = g'"
[PROOF STATE]
proof (prove)
using this:
inj agrK
agrK g = agrK g'

goal (1 subgoal):
 1. g = g'
[PROOF STEP]
by (rule injD)
[PROOF STATE]
proof (state)
this:
g = g'

goal (1 subgoal):
 1. \<And>evsFR4 S A U m n run s a b c f ga. \<lbrakk>(evsFR4, S, A, U) \<in> protocol; Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n); 0 < m; NonceS (S (User m, n, run)) = Some s; IntMapK (S (User m, n, run)) = Some a; ExtMapK (S (User m, n, run)) = Some b; IntAgrK (S (User m, n, run)) = Some c; ExtAgrK (S (User m, n, run)) = Some f; Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data ga b, pubAK ga, Crypt (priSK CA) (Hash (pubAK ga))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)); agrK g = agrK ga\<rbrakk> \<Longrightarrow> \<exists>n. g = priAK n
[PROOF STEP]
show "\<exists>n. g = priAK n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
have "?M' \<in> analz ?A \<or>
      \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', ?M g'\<rbrace>
        \<in> synth (analz ?A) \<and>
      Key (sesK (c * f)) \<in> analz ?A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<or> \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4)
[PROOF STEP]
using C
[PROOF STATE]
proof (prove)
using this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))

goal (1 subgoal):
 1. Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<or> \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4)
[PROOF STEP]
by (rule synth_crypt)
[PROOF STATE]
proof (state)
this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<or> \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<or> \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<or> \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
assume "?M' \<in> analz ?A"
[PROOF STATE]
proof (state)
this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence "?M' \<in> parts ?A"
[PROOF STATE]
proof (prove)
using this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> parts (A \<union> spies evsFR4)
[PROOF STEP]
by (rule subsetD [OF analz_parts_subset])
[PROOF STATE]
proof (state)
this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> parts (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence "\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', ?M g'\<rbrace>
        \<in> parts ?A"
[PROOF STATE]
proof (prove)
using this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> parts (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> parts (A \<union> spies evsFR4)
[PROOF STEP]
by (rule parts.Body)
[PROOF STATE]
proof (state)
this:
\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> parts (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence "?M g' \<in> parts ?A"
[PROOF STATE]
proof (prove)
using this:
\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> parts (A \<union> spies evsFR4)

goal (1 subgoal):
 1. Crypt (priSK CA) (Hash (pubAK g')) \<in> parts (A \<union> spies evsFR4)
[PROOF STEP]
by (rule_tac parts.Snd, assumption?)+
[PROOF STATE]
proof (state)
this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> parts (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence "\<exists>n. g' = priAK n"
[PROOF STATE]
proof (prove)
using this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> parts (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g' = priAK n
[PROOF STEP]
using A and D
[PROOF STATE]
proof (prove)
using this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> parts (A \<union> spies evsFR4)
Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n)
g = g'

goal (1 subgoal):
 1. \<exists>n. g' = priAK n
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
assume
       "\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', ?M g'\<rbrace>
          \<in> synth (analz ?A) \<and>
        Key (sesK (c * f)) \<in> analz ?A"
[PROOF STATE]
proof (state)
this:
\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence
       "\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', ?M g'\<rbrace>
          \<in> synth (analz ?A)"
[PROOF STATE]
proof (prove)
using this:
\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence "\<lbrace>Auth_Data g' b, pubAK g', ?M g'\<rbrace> \<in> synth (analz ?A)"
[PROOF STATE]
proof (prove)
using this:
\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))

goal (1 subgoal):
 1. \<lbrace>Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))
[PROOF STEP]
by (rule synth_analz_snd)
[PROOF STATE]
proof (state)
this:
\<lbrace>Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence "\<lbrace>pubAK g', ?M g'\<rbrace> \<in> synth (analz ?A)"
[PROOF STATE]
proof (prove)
using this:
\<lbrace>Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))

goal (1 subgoal):
 1. \<lbrace>pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))
[PROOF STEP]
by (rule synth_analz_snd)
[PROOF STATE]
proof (state)
this:
\<lbrace>pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence "?M g' \<in> synth (analz ?A)"
[PROOF STATE]
proof (prove)
using this:
\<lbrace>pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4))

goal (1 subgoal):
 1. Crypt (priSK CA) (Hash (pubAK g')) \<in> synth (analz (A \<union> spies evsFR4))
[PROOF STEP]
by (rule synth_analz_snd)
[PROOF STATE]
proof (state)
this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> synth (analz (A \<union> spies evsFR4))

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence "?M g' \<in> analz ?A \<or>
        Hash (pubAK g') \<in> synth (analz ?A) \<and> Key (priSK CA) \<in> analz ?A"
[PROOF STATE]
proof (prove)
using this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> synth (analz (A \<union> spies evsFR4))

goal (1 subgoal):
 1. Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4) \<or> Hash (pubAK g') \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (priSK CA) \<in> analz (A \<union> spies evsFR4)
[PROOF STEP]
by (rule synth_crypt)
[PROOF STATE]
proof (state)
this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4) \<or> Hash (pubAK g') \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (priSK CA) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4) \<or> Hash (pubAK g') \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (priSK CA) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4) \<or> Hash (pubAK g') \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (priSK CA) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
assume "?M g' \<in> analz ?A"
[PROOF STATE]
proof (state)
this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence "?M g' \<in> parts ?A"
[PROOF STATE]
proof (prove)
using this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. Crypt (priSK CA) (Hash (pubAK g')) \<in> parts (A \<union> spies evsFR4)
[PROOF STEP]
by (rule subsetD [OF analz_parts_subset])
[PROOF STATE]
proof (state)
this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> parts (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence "\<exists>n. g' = priAK n"
[PROOF STATE]
proof (prove)
using this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> parts (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g' = priAK n
[PROOF STEP]
using A and D
[PROOF STATE]
proof (prove)
using this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> parts (A \<union> spies evsFR4)
Crypt (priSK CA) (Hash (pubAK g)) \<in> parts (A \<union> spies evsFR4) \<longrightarrow> (\<exists>n. g = priAK n)
g = g'

goal (1 subgoal):
 1. \<exists>n. g' = priAK n
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
assume "Hash (pubAK g') \<in> synth (analz ?A) \<and>
          Key (priSK CA) \<in> analz ?A"
[PROOF STATE]
proof (state)
this:
Hash (pubAK g') \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (priSK CA) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
hence "Key (priSK CA) \<in> analz ?A"
[PROOF STATE]
proof (prove)
using this:
Hash (pubAK g') \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (priSK CA) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. Key (priSK CA) \<in> analz (A \<union> spies evsFR4)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
Key (priSK CA) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Key (priSK CA) \<in> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
have "Key (priSK CA) \<notin> analz ?A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Key (priSK CA) \<notin> analz (A \<union> spies evsFR4)
[PROOF STEP]
using B
[PROOF STATE]
proof (prove)
using this:
(evsFR4, S, A, U) \<in> protocol

goal (1 subgoal):
 1. Key (priSK CA) \<notin> analz (A \<union> spies evsFR4)
[PROOF STEP]
by (rule pr_sign_key_analz)
[PROOF STATE]
proof (state)
this:
Key (priSK CA) \<notin> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Key (priSK CA) \<in> analz (A \<union> spies evsFR4)
Key (priSK CA) \<notin> analz (A \<union> spies evsFR4)
[PROOF STEP]
have "\<exists>n. g' = priAK n"
[PROOF STATE]
proof (prove)
using this:
Key (priSK CA) \<in> analz (A \<union> spies evsFR4)
Key (priSK CA) \<notin> analz (A \<union> spies evsFR4)

goal (1 subgoal):
 1. \<exists>n. g' = priAK n
[PROOF STEP]
by contradiction
[PROOF STATE]
proof (state)
this:
\<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
Hash (pubAK g') \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (priSK CA) \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4) \<or> Hash (pubAK g') \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (priSK CA) \<in> analz (A \<union> spies evsFR4)
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n
Hash (pubAK g') \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (priSK CA) \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n
[PROOF STEP]
have "\<exists>n. g' = priAK n"
[PROOF STATE]
proof (prove)
using this:
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4) \<or> Hash (pubAK g') \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (priSK CA) \<in> analz (A \<union> spies evsFR4)
Crypt (priSK CA) (Hash (pubAK g')) \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n
Hash (pubAK g') \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (priSK CA) \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g' = priAK n
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<or> \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4)
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n
\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n
[PROOF STEP]
have "\<exists>n. g' = priAK n"
[PROOF STATE]
proof (prove)
using this:
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<or> \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4)
Crypt (sesK (c * f)) \<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n
\<lbrace>pubAK (c * (s + a * b)), Auth_Data g' b, pubAK g', Crypt (priSK CA) (Hash (pubAK g'))\<rbrace> \<in> synth (analz (A \<union> spies evsFR4)) \<and> Key (sesK (c * f)) \<in> analz (A \<union> spies evsFR4) \<Longrightarrow> \<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g' = priAK n
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
thus "\<exists>n. g = priAK n"
[PROOF STATE]
proof (prove)
using this:
\<exists>n. g' = priAK n

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
using D
[PROOF STATE]
proof (prove)
using this:
\<exists>n. g' = priAK n
g = g'

goal (1 subgoal):
 1. \<exists>n. g = priAK n
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<exists>n. g = priAK n

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>n. g = priAK n

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in nf_invar) invar_succ_step:
    assumes "v\<in>C"
    assumes "dst \<notin> E``{v} - dom PRED"
    shows "nf_invar' c src dst
      (map_mmupd PRED (E``{v} - dom PRED) v)
      (C-{v})
      (N \<union> (E``{v} - dom PRED))
      d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nf_invar' c src dst (map_mmupd PRED (E `` {v} - dom PRED) v) (C - {v}) (N \<union> (E `` {v} - dom PRED)) d
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. nf_invar' c src dst (map_mmupd PRED (E `` {v} - dom PRED) v) (C - {v}) (N \<union> (E `` {v} - dom PRED)) d
[PROOF STEP]
from C_ss_VIS[OF \<open>v\<in>C\<close>] dst_ne_VIS
[PROOF STATE]
proof (chain)
picking this:
v \<in> dom PRED
dst \<notin> dom PRED
[PROOF STEP]
have "v\<noteq>dst"
[PROOF STATE]
proof (prove)
using this:
v \<in> dom PRED
dst \<notin> dom PRED

goal (1 subgoal):
 1. v \<noteq> dst
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
v \<noteq> dst

goal (1 subgoal):
 1. nf_invar' c src dst (map_mmupd PRED (E `` {v} - dom PRED) v) (C - {v}) (N \<union> (E `` {v} - dom PRED)) d
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nf_invar' c src dst (map_mmupd PRED (E `` {v} - dom PRED) v) (C - {v}) (N \<union> (E `` {v} - dom PRED)) d
[PROOF STEP]
using \<open>v\<in>C\<close> \<open>v\<noteq>dst\<close>
[PROOF STATE]
proof (prove)
using this:
v \<in> C
v \<noteq> dst

goal (1 subgoal):
 1. nf_invar' c src dst (map_mmupd PRED (E `` {v} - dom PRED) v) (C - {v}) (N \<union> (E `` {v} - dom PRED)) d
[PROOF STEP]
apply unfold_locales
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> src \<in> V
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> finite V
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> map_mmupd PRED (E `` {v} - dom PRED) v src = Some src
 4. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> ndist va = Suc (ndist u)
 5. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> (u, va) \<in> E
 6. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 7. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 8. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 9. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 10. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> finite V
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> map_mmupd PRED (E `` {v} - dom PRED) v src = Some src
 3. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> ndist va = Suc (ndist u)
 4. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> (u, va) \<in> E
 5. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 6. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 7. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 8. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 9. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> map_mmupd PRED (E `` {v} - dom PRED) v src = Some src
 2. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> ndist va = Suc (ndist u)
 3. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> (u, va) \<in> E
 4. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 5. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 6. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 7. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 8. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (auto simp: map_mmupd_def) []
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> ndist va = Suc (ndist u)
 2. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> (u, va) \<in> E
 3. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 4. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 5. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 6. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 7. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (erule map_mmupdE)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; va \<notin> E `` {v} - dom PRED; PRED va = Some u\<rbrakk> \<Longrightarrow> ndist va = Suc (ndist u)
 2. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; va \<in> E `` {v} - dom PRED; u = v\<rbrakk> \<Longrightarrow> ndist va = Suc (ndist u)
 3. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> (u, va) \<in> E
 4. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 5. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 6. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 7. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 8. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
using PRED_dist
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?v \<noteq> src; PRED ?v = Some ?u\<rbrakk> \<Longrightarrow> ndist ?v = Suc (ndist ?u)

goal (8 subgoals):
 1. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; va \<notin> E `` {v} - dom PRED; PRED va = Some u\<rbrakk> \<Longrightarrow> ndist va = Suc (ndist u)
 2. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; va \<in> E `` {v} - dom PRED; u = v\<rbrakk> \<Longrightarrow> ndist va = Suc (ndist u)
 3. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> (u, va) \<in> E
 4. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 5. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 6. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 7. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 8. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; va \<in> E `` {v} - dom PRED; u = v\<rbrakk> \<Longrightarrow> ndist va = Suc (ndist u)
 2. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> (u, va) \<in> E
 3. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 4. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 5. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 6. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 7. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (unfold VIS_eq) []
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; va \<in> E `` {v} - (N \<union> {u. \<exists>i\<le>d. u \<in> Vd i}); u = v\<rbrakk> \<Longrightarrow> ndist va = Suc (ndist u)
 2. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> (u, va) \<in> E
 3. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 4. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 5. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 6. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 7. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>va u x. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; (v, va) \<in> E; ndist va \<noteq> Suc (ndist v); va \<notin> N\<rbrakk> \<Longrightarrow> \<exists>i\<le>d. va \<in> Vd i
 2. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> (u, va) \<in> E
 3. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 4. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 5. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 6. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 7. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (metis CVdI Vd_succ in_Vd_conv)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> (u, va) \<in> E
 2. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 4. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 5. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 6. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
using PRED_E
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?v \<noteq> src; PRED ?v = Some ?u\<rbrakk> \<Longrightarrow> (?u, ?v) \<in> E

goal (6 subgoals):
 1. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; va \<noteq> src; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> (u, va) \<in> E
 2. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 4. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 5. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 6. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (auto elim!: map_mmupdE) []
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 4. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 5. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
using PRED_closed
[PROOF STATE]
proof (prove)
using this:
PRED ?v = Some ?u \<Longrightarrow> ?u \<in> dom PRED

goal (5 subgoals):
 1. \<And>va u. \<lbrakk>v \<in> C; v \<noteq> dst; map_mmupd PRED (E `` {v} - dom PRED) v va = Some u\<rbrakk> \<Longrightarrow> u \<in> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 4. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 5. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (auto elim!: map_mmupdE dest: C_ss_VIS) []
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 4. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
using VIS_eq
[PROOF STATE]
proof (prove)
using this:
dom PRED = N \<union> {u. \<exists>i\<le>d. u \<in> Vd i}

goal (4 subgoals):
 1. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dom (map_mmupd PRED (E `` {v} - dom PRED) v) = N \<union> (E `` {v} - dom PRED) \<union> {u. \<exists>i\<le>d. u \<in> Vd i}
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 4. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply auto []
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
using C_ss
[PROOF STATE]
proof (prove)
using this:
C \<subseteq> Vd d

goal (3 subgoals):
 1. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> C - {v} \<subseteq> Vd d
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply auto []
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> N \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (unfold N_eq) []
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> Vd (d + 1) \<inter> E `` (Vd d - C) \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (frule CVdI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>v \<in> C; v \<noteq> dst; v \<in> Vd d\<rbrakk> \<Longrightarrow> Vd (d + 1) \<inter> E `` (Vd d - C) \<union> (E `` {v} - dom PRED) = Vd (d + 1) \<inter> E `` (Vd d - (C - {v}))
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (auto) []
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>v \<in> C; v \<noteq> dst; v \<in> Vd d; (v, x) \<in> E; PRED x = None\<rbrakk> \<Longrightarrow> x \<in> Vd (Suc d)
 2. \<And>x y. \<lbrakk>v \<in> C; v \<noteq> dst; x \<in> Vd (Suc d); (v, x) \<in> E; v \<in> Vd d; PRED x = Some y\<rbrakk> \<Longrightarrow> x \<in> E `` (Vd d - C)
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (erule (1) Vd_succ)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>v \<in> C; v \<noteq> dst; (v, x) \<in> E; PRED x = None\<rbrakk> \<Longrightarrow> \<forall>i\<le>d. x \<notin> Vd i
 2. \<And>x y. \<lbrakk>v \<in> C; v \<noteq> dst; x \<in> Vd (Suc d); (v, x) \<in> E; v \<in> Vd d; PRED x = Some y\<rbrakk> \<Longrightarrow> x \<in> E `` (Vd d - C)
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
using VIS_eq
[PROOF STATE]
proof (prove)
using this:
dom PRED = N \<union> {u. \<exists>i\<le>d. u \<in> Vd i}

goal (3 subgoals):
 1. \<And>x. \<lbrakk>v \<in> C; v \<noteq> dst; (v, x) \<in> E; PRED x = None\<rbrakk> \<Longrightarrow> \<forall>i\<le>d. x \<notin> Vd i
 2. \<And>x y. \<lbrakk>v \<in> C; v \<noteq> dst; x \<in> Vd (Suc d); (v, x) \<in> E; v \<in> Vd d; PRED x = Some y\<rbrakk> \<Longrightarrow> x \<in> E `` (Vd d - C)
 3. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (auto) []
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x y. \<lbrakk>v \<in> C; v \<noteq> dst; x \<in> Vd (Suc d); (v, x) \<in> E; v \<in> Vd d; PRED x = Some y\<rbrakk> \<Longrightarrow> x \<in> E `` (Vd d - C)
 2. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply (auto dest!: inPREDD simp: N_eq in_Vd_conv) []
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
using dst_ne_VIS assms(2)
[PROOF STATE]
proof (prove)
using this:
dst \<notin> dom PRED
dst \<notin> E `` {v} - dom PRED

goal (1 subgoal):
 1. \<lbrakk>v \<in> C; v \<noteq> dst\<rbrakk> \<Longrightarrow> dst \<notin> dom (map_mmupd PRED (E `` {v} - dom PRED) v)
[PROOF STEP]
apply auto []
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
nf_invar' c src dst (map_mmupd PRED (E `` {v} - dom PRED) v) (C - {v}) (N \<union> (E `` {v} - dom PRED)) d

goal:
No subgoals!
[PROOF STEP]
qed