[STATEMENT]
lemma distr_or1: "(F = F1 \<Oplus> F2) \<Longrightarrow>  ((g o_f ((N  \<Otimes>\<^sub>1 F) o f)) =
               ((g o_f ((N \<Otimes>\<^sub>1 F1) o f)) \<Oplus>  (g o_f ((N \<Otimes>\<^sub>1 F2)  o f)))) "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. F = F1 \<Oplus> F2 \<Longrightarrow> g o\<^sub>f (N \<Otimes>\<^sub>1 F \<circ> f) = (g o\<^sub>f (N \<Otimes>\<^sub>1 F1 \<circ> f)) \<Oplus> (g o\<^sub>f (N \<Otimes>\<^sub>1 F2 \<circ> f))
[PROOF STEP]
apply (rule ext)+
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. F = F1 \<Oplus> F2 \<Longrightarrow> (g o\<^sub>f (N \<Otimes>\<^sub>1 F \<circ> f)) x = ((g o\<^sub>f (N \<Otimes>\<^sub>1 F1 \<circ> f)) \<Oplus> (g o\<^sub>f (N \<Otimes>\<^sub>1 F2 \<circ> f))) x
[PROOF STEP]
apply (simp add: prod_1_def map_add_def policy_range_comp_def
      split: decision.splits option.splits)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. F = (\<lambda>x. case F1 x of \<bottom> \<Rightarrow> F2 x | \<lfloor>y\<rfloor> \<Rightarrow> \<lfloor>y\<rfloor>) \<Longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>aa ba. x2 = allow (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (aa, ba)\<rfloor> \<longrightarrow> g (a, b) = g (aa, ba)) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>aa ba. x2 = deny (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (aa, ba)\<rfloor> \<longrightarrow> g (a, b) = g (aa, ba)))))) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (a, b)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>x2. (\<forall>aa ba. x2 = allow (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (aa, ba)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>x2. (\<forall>ab bb. x2 = allow (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>ab bb. x2 = deny (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)))) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))))) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (a, b)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>aa ba. x2 = deny (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (aa, ba)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>x2. (\<forall>ab bb. x2 = allow (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>ab bb. x2 = deny (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)))))))
[PROOF STEP]
subgoal for x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. F = (\<lambda>x. case F1 x of \<bottom> \<Rightarrow> F2 x | \<lfloor>y\<rfloor> \<Rightarrow> \<lfloor>y\<rfloor>) \<Longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>aa ba. x2 = allow (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (aa, ba)\<rfloor> \<longrightarrow> g (a, b) = g (aa, ba)) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>aa ba. x2 = deny (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (aa, ba)\<rfloor> \<longrightarrow> g (a, b) = g (aa, ba)))))) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (a, b)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>x2. (\<forall>aa ba. x2 = allow (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (aa, ba)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>x2. (\<forall>ab bb. x2 = allow (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>ab bb. x2 = deny (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)))) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))))) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (a, b)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>aa ba. x2 = deny (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (aa, ba)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>x2. (\<forall>ab bb. x2 = allow (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>ab bb. x2 = deny (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)))))))
[PROOF STEP]
apply (case_tac "f x")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b. \<lbrakk>F = (\<lambda>x. case F1 x of \<bottom> \<Rightarrow> F2 x | \<lfloor>y\<rfloor> \<Rightarrow> \<lfloor>y\<rfloor>); f x = (a, b)\<rbrakk> \<Longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>aa ba. x2 = allow (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (aa, ba)\<rfloor> \<longrightarrow> g (a, b) = g (aa, ba)) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>aa ba. x2 = deny (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (aa, ba)\<rfloor> \<longrightarrow> g (a, b) = g (aa, ba)))))) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (a, b)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>x2. (\<forall>aa ba. x2 = allow (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (aa, ba)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>x2. (\<forall>ab bb. x2 = allow (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>ab bb. x2 = deny (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)))) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))))) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F1 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (a, b)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (a, b)\<rfloor> \<longrightarrow> (\<exists>y. (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>y\<rfloor>) \<and> (\<forall>x2. (\<forall>a b. x2 = allow (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>allow (a, b)\<rfloor>) \<and> (\<forall>a b. x2 = deny (a, b) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) \<noteq> \<lfloor>deny (a, b)\<rfloor>))) \<and> (\<forall>aa ba. x2 = deny (aa, ba) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case case F1 y of \<bottom> \<Rightarrow> F2 y | \<lfloor>x\<rfloor> \<Rightarrow> \<lfloor>x\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (aa, ba)\<rfloor> \<longrightarrow> ((case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<bottom> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>x2. (\<forall>ab bb. x2 = allow (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>allow (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)) \<and> (\<forall>ab bb. x2 = deny (ab, bb) \<longrightarrow> (case f x of (x, y) \<Rightarrow> case N x of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>allow (d1, d2)\<rfloor> | \<lfloor>deny d1\<rfloor> \<Rightarrow> case F2 y of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>allow d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor> | \<lfloor>deny d2\<rfloor> \<Rightarrow> \<lfloor>deny (d1, d2)\<rfloor>) = \<lfloor>deny (ab, bb)\<rfloor> \<longrightarrow> g (aa, ba) = g (a, b)))))))
[PROOF STEP]
apply (simp_all add: prod_1_def map_add_def
        split: decision.splits option.splits)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma rreq_rrep_sn_any_step_invariant:
  "paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(_, a, _). anycast rreq_rrep_sn a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(uu_, a, uu_). anycast rreq_rrep_sn a)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(uu_, a, uu_). anycast rreq_rrep_sn a)
[PROOF STEP]
have sqnf_kno: "paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l).
                                      (l \<in> {PRreq-:16..PRreq-:18} \<longrightarrow> sqnf (rt \<xi>) (dip \<xi>) = kno))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l). l \<in> {PRreq-:16..PRreq-:18} \<longrightarrow> sqnf (rt \<xi>) (dip \<xi>) = kno)
[PROOF STEP]
by (inv_cterms inv add: onl_invariant_sterms_TT [OF aodv_wf addpreRT_welldefined])
[PROOF STATE]
proof (state)
this:
paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l). l \<in> {PRreq-:16..PRreq-:18} \<longrightarrow> sqnf (rt \<xi>) (dip \<xi>) = kno)

goal (1 subgoal):
 1. paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(uu_, a, uu_). anycast rreq_rrep_sn a)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(uu_, a, uu_). anycast rreq_rrep_sn a)
[PROOF STEP]
by (inv_cterms inv add: onl_invariant_sterms_TT [OF aodv_wf addpreRT_welldefined]
                              onl_invariant_sterms [OF aodv_wf sequence_number_one_or_bigger
                                                               [THEN invariant_restrict_inD]]
                              onl_invariant_sterms [OF aodv_wf kD_unk_or_atleast_one]
                              onl_invariant_sterms_TT [OF aodv_wf sqnf_kno]
                              onl_invariant_sterms [OF aodv_wf osn_rreq]
                              onl_invariant_sterms [OF aodv_wf dsn_rrep])
         (auto simp: proj2_eq_sqn)
[PROOF STATE]
proof (state)
this:
paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(uu_, a, uu_). anycast rreq_rrep_sn a)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "P The"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P The
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P The
[PROOF STEP]
oops


[STATEMENT]
lemma "x\<^sup>\<star> \<cdot> x \<le> x\<^sup>\<star>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x\<^sup>\<star> \<cdot> x \<le> x\<^sup>\<star>
[PROOF STEP]
(*nitpick [expect=genuine]*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x\<^sup>\<star> \<cdot> x \<le> x\<^sup>\<star>
[PROOF STEP]
oops