[STATEMENT]
lemma one_step_equiv: "(T1, N1) \<leadsto>LGC (T2, N2) \<Longrightarrow> N1 \<rhd>L N2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (T1, N1) \<leadsto>LGC (T2, N2) \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
proof (cases "(T1, N1)" "(T2, N2)" rule: step.cases)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. (T1, N1) \<leadsto>LGC (T2, N2) \<Longrightarrow> (T1, N1) \<leadsto>LGC (T2, N2)
 2. \<And>N M M'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1; N1 = N \<union> M; N2 = N \<union> M'; M \<subseteq> Red_F_\<G> (N \<union> M'); active_subset M' = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 4. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 5. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
show "(T1, N1) \<leadsto>LGC (T2, N2) \<Longrightarrow> (T1, N1) \<leadsto>LGC (T2, N2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (T1, N1) \<leadsto>LGC (T2, N2) \<Longrightarrow> (T1, N1) \<leadsto>LGC (T2, N2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(T1, N1) \<leadsto>LGC (T2, N2) \<Longrightarrow> (T1, N1) \<leadsto>LGC (T2, N2)

goal (4 subgoals):
 1. \<And>N M M'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1; N1 = N \<union> M; N2 = N \<union> M'; M \<subseteq> Red_F_\<G> (N \<union> M'); active_subset M' = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 4. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>N M M'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1; N1 = N \<union> M; N2 = N \<union> M'; M \<subseteq> Red_F_\<G> (N \<union> M'); active_subset M' = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 4. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
fix N M M'
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>N M M'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1; N1 = N \<union> M; N2 = N \<union> M'; M \<subseteq> Red_F_\<G> (N \<union> M'); active_subset M' = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 4. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
assume
    n1_is: "N1 = N \<union> M" and
    n2_is: "N2 = N \<union> M'" and
    m_red: "M \<subseteq> Red_F (N \<union> M')"
[PROOF STATE]
proof (state)
this:
N1 = N \<union> M
N2 = N \<union> M'
M \<subseteq> Red_F_\<G> (N \<union> M')

goal (4 subgoals):
 1. \<And>N M M'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1; N1 = N \<union> M; N2 = N \<union> M'; M \<subseteq> Red_F_\<G> (N \<union> M'); active_subset M' = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 4. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
have "N1 - N2 \<subseteq> Red_F N2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
using n1_is n2_is m_red
[PROOF STATE]
proof (prove)
using this:
N1 = N \<union> M
N2 = N \<union> M'
M \<subseteq> Red_F_\<G> (N \<union> M')

goal (1 subgoal):
 1. N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (4 subgoals):
 1. \<And>N M M'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1; N1 = N \<union> M; N2 = N \<union> M'; M \<subseteq> Red_F_\<G> (N \<union> M'); active_subset M' = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 4. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
show "N1 \<rhd>L N2"
[PROOF STATE]
proof (prove)
using this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (1 subgoal):
 1. N1 \<rhd>L N2
[PROOF STEP]
unfolding derive.simps
[PROOF STATE]
proof (prove)
using this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (1 subgoal):
 1. \<exists>M N. N1 = M \<and> N2 = N \<and> M - N \<subseteq> Red_F_\<G> N
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
N1 \<rhd>L N2

goal (3 subgoals):
 1. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
fix N C L M
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
assume
    n1_is: "N1 = N \<union> {(C, L)}" and
    not_active: "L \<noteq> active" and
    n2_is: "N2 = N \<union> {(C, active)}"
[PROOF STATE]
proof (state)
this:
N1 = N \<union> {(C, L)}
L \<noteq> active
N2 = N \<union> {(C, active)}

goal (3 subgoals):
 1. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
have "(C, active) \<in> N2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (C, active) \<in> N2
[PROOF STEP]
using n2_is
[PROOF STATE]
proof (prove)
using this:
N2 = N \<union> {(C, active)}

goal (1 subgoal):
 1. (C, active) \<in> N2
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(C, active) \<in> N2

goal (3 subgoals):
 1. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(C, active) \<in> N2

goal (3 subgoals):
 1. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
have "C \<preceq>\<cdot> C"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. C \<preceq>\<cdot> C
[PROOF STEP]
by (metis equivp_def equiv_equiv_F)
[PROOF STATE]
proof (state)
this:
C \<preceq>\<cdot> C

goal (3 subgoals):
 1. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
C \<preceq>\<cdot> C

goal (3 subgoals):
 1. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
have "active \<sqsubset>L L"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. active \<sqsubset>L L
[PROOF STEP]
using active_minimal[OF not_active]
[PROOF STATE]
proof (prove)
using this:
active \<sqsubset>L L

goal (1 subgoal):
 1. active \<sqsubset>L L
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
active \<sqsubset>L L

goal (3 subgoals):
 1. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(C, active) \<in> N2
C \<preceq>\<cdot> C
active \<sqsubset>L L
[PROOF STEP]
have "{(C, L)} \<subseteq> Red_F N2"
[PROOF STATE]
proof (prove)
using this:
(C, active) \<in> N2
C \<preceq>\<cdot> C
active \<sqsubset>L L

goal (1 subgoal):
 1. {(C, L)} \<subseteq> Red_F_\<G> N2
[PROOF STEP]
using red_labeled_clauses
[PROOF STATE]
proof (prove)
using this:
(C, active) \<in> N2
C \<preceq>\<cdot> C
active \<sqsubset>L L
?C \<in> no_labels.Red_F_\<G>_empty (fst ` ?N) \<or> (\<exists>C'\<in>fst ` ?N. C' \<prec>\<cdot> ?C) \<or> (\<exists>(C', L')\<in>?N. L' \<sqsubset>L ?L \<and> C' \<preceq>\<cdot> ?C) \<Longrightarrow> (?C, ?L) \<in> Red_F_\<G> ?N

goal (1 subgoal):
 1. {(C, L)} \<subseteq> Red_F_\<G> N2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
{(C, L)} \<subseteq> Red_F_\<G> N2

goal (3 subgoals):
 1. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
{(C, L)} \<subseteq> Red_F_\<G> N2
[PROOF STEP]
have "N1 - N2 \<subseteq> Red_F N2"
[PROOF STATE]
proof (prove)
using this:
{(C, L)} \<subseteq> Red_F_\<G> N2

goal (1 subgoal):
 1. N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
using std_Red_F_eq
[PROOF STATE]
proof (prove)
using this:
{(C, L)} \<subseteq> Red_F_\<G> N2
std.Red_F = Red_F_\<G>_empty

goal (1 subgoal):
 1. N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
using n1_is n2_is
[PROOF STATE]
proof (prove)
using this:
{(C, L)} \<subseteq> Red_F_\<G> N2
std.Red_F = Red_F_\<G>_empty
N1 = N \<union> {(C, L)}
N2 = N \<union> {(C, active)}

goal (1 subgoal):
 1. N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (3 subgoals):
 1. \<And>T' N C L. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T2 = T1 \<union> T'; N1 = N \<union> {(C, L)}; N2 = N \<union> {(C, active)}; L \<noteq> active; T' = no_labels.Inf_between (fst ` active_subset N) {C}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 3. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
show "N1 \<rhd>L N2"
[PROOF STATE]
proof (prove)
using this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (1 subgoal):
 1. N1 \<rhd>L N2
[PROOF STEP]
unfolding derive.simps
[PROOF STATE]
proof (prove)
using this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (1 subgoal):
 1. \<exists>M N. N1 = M \<and> N2 = N \<and> M - N \<subseteq> Red_F_\<G> N
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
N1 \<rhd>L N2

goal (2 subgoals):
 1. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
fix M
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
assume
    n2_is: "N2 = N1 \<union> M"
[PROOF STATE]
proof (state)
this:
N2 = N1 \<union> M

goal (2 subgoals):
 1. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
have "N1 - N2 \<subseteq> Red_F N2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
using n2_is
[PROOF STATE]
proof (prove)
using this:
N2 = N1 \<union> M

goal (1 subgoal):
 1. N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (2 subgoals):
 1. \<And>\<iota> M. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); T1 = T2 \<union> {\<iota>}; N2 = N1 \<union> M; active_subset M = {}; \<iota> \<in> no_labels.Red_I_\<G> (fst ` (N1 \<union> M))\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
 2. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
show "N1 \<rhd>L N2"
[PROOF STATE]
proof (prove)
using this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (1 subgoal):
 1. N1 \<rhd>L N2
[PROOF STEP]
unfolding derive.simps
[PROOF STATE]
proof (prove)
using this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (1 subgoal):
 1. \<exists>M N. N1 = M \<and> N2 = N \<and> M - N \<subseteq> Red_F_\<G> N
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
N1 \<rhd>L N2

goal (1 subgoal):
 1. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
assume n2_is: "N2 = N1"
[PROOF STATE]
proof (state)
this:
N2 = N1

goal (1 subgoal):
 1. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
have "N1 - N2 \<subseteq> Red_F N2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
using n2_is
[PROOF STATE]
proof (prove)
using this:
N2 = N1

goal (1 subgoal):
 1. N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (1 subgoal):
 1. \<And>T'. \<lbrakk>(T1, N1) \<leadsto>LGC (T2, N2); N2 = N1; T1 = T2 \<union> T'; T' \<inter> no_labels.Inf_from (fst ` active_subset N1) = {}\<rbrakk> \<Longrightarrow> N1 \<rhd>L N2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
N1 - N2 \<subseteq> Red_F_\<G> N2
[PROOF STEP]
show "N1 \<rhd>L N2"
[PROOF STATE]
proof (prove)
using this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (1 subgoal):
 1. N1 \<rhd>L N2
[PROOF STEP]
unfolding derive.simps
[PROOF STATE]
proof (prove)
using this:
N1 - N2 \<subseteq> Red_F_\<G> N2

goal (1 subgoal):
 1. \<exists>M N. N1 = M \<and> N2 = N \<and> M - N \<subseteq> Red_F_\<G> N
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
N1 \<rhd>L N2

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma real_alg_2':
  assumes ur: "unique_root (q,l,r)" and pc: "poly_cond q" and ri: "root_info_cond ri q"
  shows "invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = the_unique_root (q,l,r)" (is "_ \<and> _ = ?x")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
proof (cases "degree q" "Suc 0" rule: linorder_cases)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. degree q < Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 2. degree q = Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 3. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
case deg: less
[PROOF STATE]
proof (state)
this:
degree q < Suc 0

goal (3 subgoals):
 1. degree q < Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 2. degree q = Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 3. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
degree q < Suc 0
[PROOF STEP]
have "degree q = 0"
[PROOF STATE]
proof (prove)
using this:
degree q < Suc 0

goal (1 subgoal):
 1. degree q = 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
degree q = 0

goal (3 subgoals):
 1. degree q < Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 2. degree q = Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 3. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
from poly_cond_degree_0_imp_no_root[OF pc this] ur
[PROOF STATE]
proof (chain)
picking this:
ipoly q ?x \<noteq> (0::?'b)
\<exists>!x. root_cond (q, l, r) x
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
ipoly q ?x \<noteq> (0::?'b)
\<exists>!x. root_cond (q, l, r) x

goal (1 subgoal):
 1. False
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
False

goal (3 subgoals):
 1. degree q < Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 2. degree q = Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 3. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
False
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)

goal (2 subgoals):
 1. degree q = Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 2. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. degree q = Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 2. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
case deg: equal
[PROOF STATE]
proof (state)
this:
degree q = Suc 0

goal (2 subgoals):
 1. degree q = Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 2. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
hence id: "real_alg_2' ri q l r = Rational (Rat.Fract (- coeff q 0) (coeff q 1))"
[PROOF STATE]
proof (prove)
using this:
degree q = Suc 0

goal (1 subgoal):
 1. real_alg_2' ri q l r = Rational (Rat.Fract (- coeff q 0) (coeff q 1))
[PROOF STEP]
unfolding real_alg_2'_def
[PROOF STATE]
proof (prove)
using this:
degree q = Suc 0

goal (1 subgoal):
 1. (if degree q = 1 then Rational (Rat.Fract (- coeff q 0) (coeff q 1)) else real_alg_2_main ri (case tighten_poly_bounds_for_x q 0 l r (sgn (ipoly q r)) of (l', r', sr') \<Rightarrow> (q, l', r'))) = Rational (Rat.Fract (- coeff q 0) (coeff q 1))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
real_alg_2' ri q l r = Rational (Rat.Fract (- coeff q 0) (coeff q 1))

goal (2 subgoals):
 1. degree q = Suc 0 \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
 2. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
unfolding id
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. invariant_2 (Rational (Rat.Fract (- coeff q 0) (coeff q 1))) \<and> real_of_2 (Rational (Rat.Fract (- coeff q 0) (coeff q 1))) = real_of_1 (q, l, r)
[PROOF STEP]
using degree_1_ipoly[OF deg]
[PROOF STATE]
proof (prove)
using this:
(poly (real_of_int_poly q) ?x = 0) = (?x = real_of_rat (Rat.Fract (- coeff q 0) (coeff q 1)))

goal (1 subgoal):
 1. invariant_2 (Rational (Rat.Fract (- coeff q 0) (coeff q 1))) \<and> real_of_2 (Rational (Rat.Fract (- coeff q 0) (coeff q 1))) = real_of_1 (q, l, r)
[PROOF STEP]
using unique_rootD(4)[OF ur]
[PROOF STATE]
proof (prove)
using this:
(poly (real_of_int_poly q) ?x = 0) = (?x = real_of_rat (Rat.Fract (- coeff q 0) (coeff q 1)))
root_cond (q, l, r) (real_of_1 (q, l, r))

goal (1 subgoal):
 1. invariant_2 (Rational (Rat.Fract (- coeff q 0) (coeff q 1))) \<and> real_of_2 (Rational (Rat.Fract (- coeff q 0) (coeff q 1))) = real_of_1 (q, l, r)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)

goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
case deg: greater
[PROOF STATE]
proof (state)
this:
Suc 0 < degree q

goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
with pc
[PROOF STATE]
proof (chain)
picking this:
poly_cond q
Suc 0 < degree q
[PROOF STEP]
have pc2: "poly_cond2 q"
[PROOF STATE]
proof (prove)
using this:
poly_cond q
Suc 0 < degree q

goal (1 subgoal):
 1. poly_cond2 q
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
poly_cond2 q

goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
let ?rai = "real_alg_2' ri q l r"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
let ?r = real_of_rat
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
obtain l' r' sr' where tight: "tighten_poly_bounds_for_x q 0 l r (sgn (ipoly q r)) = (l',r',sr')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>l' r' sr'. tighten_poly_bounds_for_x q 0 l r (sgn (ipoly q r)) = (l', r', sr') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases rule: prod_cases3, auto)
[PROOF STATE]
proof (state)
this:
tighten_poly_bounds_for_x q 0 l r (sgn (ipoly q r)) = (l', r', sr')

goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
let ?rai' = "(q, l', r')"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
have rai': "?rai = real_alg_2_main ri ?rai'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_alg_2' ri q l r = real_alg_2_main ri (q, l', r')
[PROOF STEP]
unfolding real_alg_2'_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if degree q = 1 then Rational (Rat.Fract (- coeff q 0) (coeff q 1)) else real_alg_2_main ri (case tighten_poly_bounds_for_x q 0 l r (sgn (ipoly q r)) of (l', r', sr') \<Rightarrow> (q, l', r'))) = real_alg_2_main ri (q, l', r')
[PROOF STEP]
using deg tight
[PROOF STATE]
proof (prove)
using this:
Suc 0 < degree q
tighten_poly_bounds_for_x q 0 l r (sgn (ipoly q r)) = (l', r', sr')

goal (1 subgoal):
 1. (if degree q = 1 then Rational (Rat.Fract (- coeff q 0) (coeff q 1)) else real_alg_2_main ri (case tighten_poly_bounds_for_x q 0 l r (sgn (ipoly q r)) of (l', r', sr') \<Rightarrow> (q, l', r'))) = real_alg_2_main ri (q, l', r')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
real_alg_2' ri q l r = real_alg_2_main ri (q, l', r')

goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
hence rai: "real_of_1 ?rai' = the_unique_root (q,l',r')"
[PROOF STATE]
proof (prove)
using this:
real_alg_2' ri q l r = real_alg_2_main ri (q, l', r')

goal (1 subgoal):
 1. real_of_1 (q, l', r') = real_of_1 (q, l', r')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
real_of_1 (q, l', r') = real_of_1 (q, l', r')

goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
note tight = tighten_poly_bounds_for_x[OF ur pc2 tight refl]
[PROOF STATE]
proof (state)
this:
l \<le> l'
l' \<le> r'
r' \<le> r
root_cond (q, l', r') (real_of_1 (q, l, r))
\<not> (l' \<le> 0 \<and> 0 \<le> r')
sr' = sgn (ipoly q r')
\<exists>!x. root_cond (q, l', r') x

goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
let ?x = "the_unique_root (q, l, r)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
from tight
[PROOF STATE]
proof (chain)
picking this:
l \<le> l'
l' \<le> r'
r' \<le> r
root_cond (q, l', r') (real_of_1 (q, l, r))
\<not> (l' \<le> 0 \<and> 0 \<le> r')
sr' = sgn (ipoly q r')
\<exists>!x. root_cond (q, l', r') x
[PROOF STEP]
have tight: "root_cond (q,l',r') ?x" "l \<le> l'" "l' \<le> r'" "r' \<le> r" "l' > 0 \<or> r' < 0"
[PROOF STATE]
proof (prove)
using this:
l \<le> l'
l' \<le> r'
r' \<le> r
root_cond (q, l', r') (real_of_1 (q, l, r))
\<not> (l' \<le> 0 \<and> 0 \<le> r')
sr' = sgn (ipoly q r')
\<exists>!x. root_cond (q, l', r') x

goal (1 subgoal):
 1. (root_cond (q, l', r') (real_of_1 (q, l, r)) &&& l \<le> l') &&& l' \<le> r' &&& r' \<le> r &&& 0 < l' \<or> r' < 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
root_cond (q, l', r') (real_of_1 (q, l, r))
l \<le> l'
l' \<le> r'
r' \<le> r
0 < l' \<or> r' < 0

goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
from unique_root_sub_interval[OF ur tight(1) tight(2,4)] poly_condD[OF pc]
[PROOF STATE]
proof (chain)
picking this:
\<exists>!x. root_cond (q, l', r') x
real_of_1 (q, l', r') = real_of_1 (q, l, r)
irreducible q
0 < lead_coeff q
root_free q
square_free q
q \<noteq> 0
[PROOF STEP]
have ur': "unique_root (q, l', r')" and x: "?x = the_unique_root (q,l',r')"
[PROOF STATE]
proof (prove)
using this:
\<exists>!x. root_cond (q, l', r') x
real_of_1 (q, l', r') = real_of_1 (q, l, r)
irreducible q
0 < lead_coeff q
root_free q
square_free q
q \<noteq> 0

goal (1 subgoal):
 1. \<exists>!x. root_cond (q, l', r') x &&& real_of_1 (q, l, r) = real_of_1 (q, l', r')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>!x. root_cond (q, l', r') x
real_of_1 (q, l, r) = real_of_1 (q, l', r')

goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
from tight(2-)
[PROOF STATE]
proof (chain)
picking this:
l \<le> l'
l' \<le> r'
r' \<le> r
0 < l' \<or> r' < 0
[PROOF STEP]
have sgn: "sgn l' = sgn r'"
[PROOF STATE]
proof (prove)
using this:
l \<le> l'
l' \<le> r'
r' \<le> r
0 < l' \<or> r' < 0

goal (1 subgoal):
 1. sgn l' = sgn r'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
sgn l' = sgn r'

goal (1 subgoal):
 1. Suc 0 < degree q \<Longrightarrow> invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)
[PROOF STEP]
unfolding rai'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. invariant_2 (real_alg_2_main ri (q, l', r')) \<and> real_of_2 (real_alg_2_main ri (q, l', r')) = real_of_1 (q, l, r)
[PROOF STEP]
using real_alg_2_main[of ?rai' ri] invariant_1_realI[of ?rai' ?x]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>invariant_1 (q, l', r'); irreducible (poly_real_alg_1 (q, l', r')) \<Longrightarrow> root_info_cond ri (poly_real_alg_1 (q, l', r'))\<rbrakk> \<Longrightarrow> invariant_2 (real_alg_2_main ri (q, l', r'))
\<lbrakk>invariant_1 (q, l', r'); irreducible (poly_real_alg_1 (q, l', r')) \<Longrightarrow> root_info_cond ri (poly_real_alg_1 (q, l', r'))\<rbrakk> \<Longrightarrow> real_of_2 (real_alg_2_main ri (q, l', r')) = real_of_1 (q, l', r')
\<lbrakk>root_cond (q, l', r') (real_of_1 (q, l, r)); sgn (rai_lb (q, l', r')) = sgn (rai_ub (q, l', r')); \<exists>!x. root_cond (q, l', r') x; poly_cond (poly_real_alg_1 (q, l', r'))\<rbrakk> \<Longrightarrow> invariant_1 (q, l', r') \<and> real_of_1 (q, l', r') = real_of_1 (q, l, r)

goal (1 subgoal):
 1. invariant_2 (real_alg_2_main ri (q, l', r')) \<and> real_of_2 (real_alg_2_main ri (q, l', r')) = real_of_1 (q, l, r)
[PROOF STEP]
by (auto simp: tight(1) sgn pc ri ur')
[PROOF STATE]
proof (state)
this:
invariant_2 (real_alg_2' ri q l r) \<and> real_of_2 (real_alg_2' ri q l r) = real_of_1 (q, l, r)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma exec_step_into_redT:
  assumes invar: "state_invar s" "\<sigma>_invar \<sigma> (dom (thr_\<alpha> (thr s)))" "state_\<alpha> s \<in> invariant"
  and wstok: "wset_thread_ok (ws_\<alpha> (wset s)) (thr_\<alpha> (thr s))"
  and exec: "exec_step (\<sigma>, s) = Inl ((\<sigma>'', t, ta), \<sigma>', s')"
  shows "\<alpha>.redT (state_\<alpha> s) (t, ta) (state_\<alpha> s')" "\<sigma>'' = \<sigma>"
  and "state_invar s'" "\<sigma>_invar \<sigma>' (dom (thr_\<alpha> (thr s')))" "state_\<alpha> s' \<in> invariant"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<alpha>.redT_syntax1 (state_\<alpha> s) t ta (state_\<alpha> s') &&& \<sigma>'' = \<sigma>) &&& state_invar s' &&& \<sigma>_invar \<sigma>' (dom (thr_\<alpha> (thr s'))) &&& state_\<alpha> s' \<in> invariant
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<alpha>.redT_syntax1 (state_\<alpha> s) t ta (state_\<alpha> s')
 2. \<sigma>'' = \<sigma>
 3. state_invar s'
 4. \<sigma>_invar \<sigma>' (dom (thr_\<alpha> (thr s')))
 5. state_\<alpha> s' \<in> invariant
[PROOF STEP]
from exec
[PROOF STATE]
proof (chain)
picking this:
exec_step (\<sigma>, s) = Inl ((\<sigma>'', t, ta), \<sigma>', s')
[PROOF STEP]
have execT: "execT \<sigma> s = \<lfloor>(\<sigma>', t, ta, s')\<rfloor>"
    and q: "\<sigma>'' = \<sigma>"
[PROOF STATE]
proof (prove)
using this:
exec_step (\<sigma>, s) = Inl ((\<sigma>'', t, ta), \<sigma>', s')

goal (1 subgoal):
 1. execT \<sigma> s = \<lfloor>(\<sigma>', t, ta, s')\<rfloor> &&& \<sigma>'' = \<sigma>
[PROOF STEP]
by(auto simp add: exec_step.simps split_beta)
[PROOF STATE]
proof (state)
this:
execT \<sigma> s = \<lfloor>(\<sigma>', t, ta, s')\<rfloor>
\<sigma>'' = \<sigma>

goal (5 subgoals):
 1. \<alpha>.redT_syntax1 (state_\<alpha> s) t ta (state_\<alpha> s')
 2. \<sigma>'' = \<sigma>
 3. state_invar s'
 4. \<sigma>_invar \<sigma>' (dom (thr_\<alpha> (thr s')))
 5. state_\<alpha> s' \<in> invariant
[PROOF STEP]
from invar wstok execT
[PROOF STATE]
proof (chain)
picking this:
state_invar s
\<sigma>_invar \<sigma> (dom (thr_\<alpha> (thr s)))
state_\<alpha> s \<in> invariant
wset_thread_ok (ws_\<alpha> (wset s)) (thr_\<alpha> (thr s))
execT \<sigma> s = \<lfloor>(\<sigma>', t, ta, s')\<rfloor>
[PROOF STEP]
show red: "\<alpha>.redT (state_\<alpha> s) (t, ta) (state_\<alpha> s')"
    and invar': "state_invar s'" "\<sigma>_invar \<sigma>' (dom (thr_\<alpha> (thr s')))" "\<sigma>'' = \<sigma>"
[PROOF STATE]
proof (prove)
using this:
state_invar s
\<sigma>_invar \<sigma> (dom (thr_\<alpha> (thr s)))
state_\<alpha> s \<in> invariant
wset_thread_ok (ws_\<alpha> (wset s)) (thr_\<alpha> (thr s))
execT \<sigma> s = \<lfloor>(\<sigma>', t, ta, s')\<rfloor>

goal (1 subgoal):
 1. \<alpha>.redT_syntax1 (state_\<alpha> s) t ta (state_\<alpha> s') &&& state_invar s' &&& \<sigma>_invar \<sigma>' (dom (thr_\<alpha> (thr s'))) &&& \<sigma>'' = \<sigma>
[PROOF STEP]
by(rule execT_Some)+(rule q)
[PROOF STATE]
proof (state)
this:
\<alpha>.redT_syntax1 (state_\<alpha> s) t ta (state_\<alpha> s')
state_invar s'
\<sigma>_invar \<sigma>' (dom (thr_\<alpha> (thr s')))
\<sigma>'' = \<sigma>

goal (1 subgoal):
 1. state_\<alpha> s' \<in> invariant
[PROOF STEP]
from invariant red \<open>state_\<alpha> s \<in> invariant\<close>
[PROOF STATE]
proof (chain)
picking this:
invariant3p \<alpha>.redT invariant
\<alpha>.redT_syntax1 (state_\<alpha> s) t ta (state_\<alpha> s')
state_\<alpha> s \<in> invariant
[PROOF STEP]
show "state_\<alpha> s' \<in> invariant"
[PROOF STATE]
proof (prove)
using this:
invariant3p \<alpha>.redT invariant
\<alpha>.redT_syntax1 (state_\<alpha> s) t ta (state_\<alpha> s')
state_\<alpha> s \<in> invariant

goal (1 subgoal):
 1. state_\<alpha> s' \<in> invariant
[PROOF STEP]
by(rule invariant3pD)
[PROOF STATE]
proof (state)
this:
state_\<alpha> s' \<in> invariant

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma init_config_implies_InvRecordCount: "init_config c \<Longrightarrow> InvRecordCount c"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. init_config c \<Longrightarrow> InvRecordCount c
[PROOF STEP]
by (simp add: InvRecordCount_def init_config_def GlobalIncomingInfo_def IncomingInfo_def)


[STATEMENT]
theorem general_completeness:
  assumes "\<And>a u T x. (a, u, T) \<in> S \<Longrightarrow> Some x = a \<oplus> T f \<Longrightarrow> sat A x"
      and "Some \<phi> = \<phi>' \<oplus> f"
      and "stable f"
      and "valid_package_set S unit"
      and "wf_assertion A"
    shows "\<exists>S'. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>S'. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>S'. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S'
[PROOF STEP]
define S' where "S' = { (r, u, T) |a u T r. (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u }"
[PROOF STATE]
proof (state)
this:
S' = {uu_. \<exists>a u T r. uu_ = (r, u, T) \<and> (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u}

goal (1 subgoal):
 1. \<exists>S'. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S'
[PROOF STEP]
let ?pc = "\<lambda>_. True"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>S'. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S'
[PROOF STEP]
have "\<exists>S''. package_rhs \<phi>' f S' ?pc A \<phi>' f S''"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''
[PROOF STEP]
let ?f2 = "\<lambda>a u T. unit"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''
[PROOF STEP]
let ?f1 = "\<lambda>a u T. a"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''
[PROOF STEP]
have "\<exists>S''. package_rhs \<phi>' f S' ?pc A \<phi>' f S'' \<and> (\<forall>(a', u', T) \<in> S''. \<exists>a u. (a, u, T) \<in> S' \<and> a' \<succeq> ?f2 a u T \<and> |a'| = |a| )"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S'' \<and> (\<forall>(a', u', T)\<in>S''. \<exists>a u. (a, u, T) \<in> S' \<and> a' \<succeq> unit \<and>  |a'|  =  |a| )
[PROOF STEP]
proof (rule completeness_aux)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow>  |?f1.0 a u T|  \<succeq>  |a|  \<and> Some a = ?f1.0 a u T \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> ?f1.0 a u T)))
 2. valid_package_set S' f
 3. wf_assertion A
 4. mono_pure_cond (\<lambda>_. True)
 5. stable f \<and> \<phi>' ## f
[PROOF STEP]
show "mono_pure_cond (\<lambda>_. True)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mono_pure_cond (\<lambda>_. True)
[PROOF STEP]
by (simp add: mono_pure_cond_def)
[PROOF STATE]
proof (state)
this:
mono_pure_cond (\<lambda>_. True)

goal (4 subgoals):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow>  |?f1.0 a u T|  \<succeq>  |a|  \<and> Some a = ?f1.0 a u T \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> ?f1.0 a u T)))
 2. valid_package_set S' f
 3. wf_assertion A
 4. stable f \<and> \<phi>' ## f
[PROOF STEP]
show "wf_assertion A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf_assertion A
[PROOF STEP]
by (simp add: assms(5))
[PROOF STATE]
proof (state)
this:
wf_assertion A

goal (3 subgoals):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow>  |?f1.0 a u T|  \<succeq>  |a|  \<and> Some a = ?f1.0 a u T \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> ?f1.0 a u T)))
 2. valid_package_set S' f
 3. stable f \<and> \<phi>' ## f
[PROOF STEP]
show "valid_package_set S' f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. valid_package_set S' f
[PROOF STEP]
proof (rule valid_package_setI)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow> a ## u \<and>  |a|  \<succeq>  |u|  \<and> mono_transformer T \<and> a \<succeq>  |T f|
[PROOF STEP]
fix a' u' T
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow> a ## u \<and>  |a|  \<succeq>  |u|  \<and> mono_transformer T \<and> a \<succeq>  |T f|
[PROOF STEP]
assume "(a', u', T) \<in> S'"
[PROOF STATE]
proof (state)
this:
(a', u', T) \<in> S'

goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow> a ## u \<and>  |a|  \<succeq>  |u|  \<and> mono_transformer T \<and> a \<succeq>  |T f|
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(a', u', T) \<in> S'
[PROOF STEP]
obtain a where asm: "(a, u', T) \<in> S \<and> Some a' = a \<oplus> (T f \<ominus> T unit) \<and> a' ## u'"
[PROOF STATE]
proof (prove)
using this:
(a', u', T) \<in> S'

goal (1 subgoal):
 1. (\<And>a. (a, u', T) \<in> S \<and> Some a' = a \<oplus> (T f \<ominus> T unit) \<and> a' ## u' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using S'_def
[PROOF STATE]
proof (prove)
using this:
(a', u', T) \<in> S'
S' = {uu_. \<exists>a u T r. uu_ = (r, u, T) \<and> (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u}

goal (1 subgoal):
 1. (\<And>a. (a, u', T) \<in> S \<and> Some a' = a \<oplus> (T f \<ominus> T unit) \<and> a' ## u' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(a, u', T) \<in> S \<and> Some a' = a \<oplus> (T f \<ominus> T unit) \<and> a' ## u'

goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow> a ## u \<and>  |a|  \<succeq>  |u|  \<and> mono_transformer T \<and> a \<succeq>  |T f|
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(a, u', T) \<in> S \<and> Some a' = a \<oplus> (T f \<ominus> T unit) \<and> a' ## u'
[PROOF STEP]
have "a ## u' \<and>  |a|  \<succeq>  |u'|  \<and> mono_transformer T "
[PROOF STATE]
proof (prove)
using this:
(a, u', T) \<in> S \<and> Some a' = a \<oplus> (T f \<ominus> T unit) \<and> a' ## u'

goal (1 subgoal):
 1. a ## u' \<and>  |a|  \<succeq>  |u'|  \<and> mono_transformer T
[PROOF STEP]
using assms(4) valid_package_set_def
[PROOF STATE]
proof (prove)
using this:
(a, u', T) \<in> S \<and> Some a' = a \<oplus> (T f \<ominus> T unit) \<and> a' ## u'
valid_package_set S unit
valid_package_set ?S ?f = (\<forall>(a, u, T)\<in>?S. a ## u \<and>  |a|  \<succeq>  |u|  \<and> mono_transformer T \<and> a \<succeq>  |T ?f| )

goal (1 subgoal):
 1. a ## u' \<and>  |a|  \<succeq>  |u'|  \<and> mono_transformer T
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
a ## u' \<and>  |a|  \<succeq>  |u'|  \<and> mono_transformer T

goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow> a ## u \<and>  |a|  \<succeq>  |u|  \<and> mono_transformer T \<and> a \<succeq>  |T f|
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
a ## u' \<and>  |a|  \<succeq>  |u'|  \<and> mono_transformer T

goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow> a ## u \<and>  |a|  \<succeq>  |u|  \<and> mono_transformer T \<and> a \<succeq>  |T f|
[PROOF STEP]
have "|T f \<ominus> T unit| = |T f|"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1.  |T f \<ominus> T unit|  =  |T f|
[PROOF STEP]
by (simp add: minus_core)
[PROOF STATE]
proof (state)
this:
 |T f \<ominus> T unit|  =  |T f|

goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow> a ## u \<and>  |a|  \<succeq>  |u|  \<and> mono_transformer T \<and> a \<succeq>  |T f|
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
a ## u' \<and>  |a|  \<succeq>  |u'|  \<and> mono_transformer T
 |T f \<ominus> T unit|  =  |T f|
[PROOF STEP]
show "a' ## u' \<and>  |a'|  \<succeq>  |u'|  \<and> mono_transformer T \<and> a' \<succeq>  |T f| "
[PROOF STATE]
proof (prove)
using this:
a ## u' \<and>  |a|  \<succeq>  |u'|  \<and> mono_transformer T
 |T f \<ominus> T unit|  =  |T f|

goal (1 subgoal):
 1. a' ## u' \<and>  |a'|  \<succeq>  |u'|  \<and> mono_transformer T \<and> a' \<succeq>  |T f|
[PROOF STEP]
by (meson asm core_sum greater_def greater_equiv minus_equiv_def mono_transformer_def succ_trans unit_neutral)
[PROOF STATE]
proof (state)
this:
a' ## u' \<and>  |a'|  \<succeq>  |u'|  \<and> mono_transformer T \<and> a' \<succeq>  |T f|

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
valid_package_set S' f

goal (2 subgoals):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow>  |?f1.0 a u T|  \<succeq>  |a|  \<and> Some a = ?f1.0 a u T \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> ?f1.0 a u T)))
 2. stable f \<and> \<phi>' ## f
[PROOF STEP]
show "stable f \<and> \<phi>' ## f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. stable f \<and> \<phi>' ## f
[PROOF STEP]
by (metis assms(2) assms(3) defined_def domI domIff)
[PROOF STATE]
proof (state)
this:
stable f \<and> \<phi>' ## f

goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow>  |?f1.0 a u T|  \<succeq>  |a|  \<and> Some a = ?f1.0 a u T \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> ?f1.0 a u T)))
[PROOF STEP]
fix a u T
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow>  |?f1.0 a u T|  \<succeq>  |a|  \<and> Some a = ?f1.0 a u T \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> ?f1.0 a u T)))
[PROOF STEP]
assume "(a, u, T) \<in> S'"
[PROOF STATE]
proof (state)
this:
(a, u, T) \<in> S'

goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow>  |?f1.0 a u T|  \<succeq>  |a|  \<and> Some a = ?f1.0 a u T \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> ?f1.0 a u T)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(a, u, T) \<in> S'
[PROOF STEP]
obtain a' u' where "(a', u', T) \<in> S" "Some a = a' \<oplus> (T f \<ominus> T unit)"
[PROOF STATE]
proof (prove)
using this:
(a, u, T) \<in> S'

goal (1 subgoal):
 1. (\<And>a' u'. \<lbrakk>(a', u', T) \<in> S; Some a = a' \<oplus> (T f \<ominus> T unit)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using S'_def
[PROOF STATE]
proof (prove)
using this:
(a, u, T) \<in> S'
S' = {uu_. \<exists>a u T r. uu_ = (r, u, T) \<and> (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u}

goal (1 subgoal):
 1. (\<And>a' u'. \<lbrakk>(a', u', T) \<in> S; Some a = a' \<oplus> (T f \<ominus> T unit)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(a', u', T) \<in> S
Some a = a' \<oplus> (T f \<ominus> T unit)

goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow>  |?f1.0 a u T|  \<succeq>  |a|  \<and> Some a = ?f1.0 a u T \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> ?f1.0 a u T)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(a', u', T) \<in> S
Some a = a' \<oplus> (T f \<ominus> T unit)

goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow>  |?f1.0 a u T|  \<succeq>  |a|  \<and> Some a = ?f1.0 a u T \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> ?f1.0 a u T)))
[PROOF STEP]
have "T f \<ominus> T unit = T f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. T f \<ominus> T unit = T f
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. T f \<ominus> T unit = T f
[PROOF STEP]
have "mono_transformer T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mono_transformer T
[PROOF STEP]
using \<open>valid_package_set S unit\<close> valid_package_set_def \<open>(a', u', T) \<in> S\<close>
[PROOF STATE]
proof (prove)
using this:
valid_package_set S unit
valid_package_set ?S ?f = (\<forall>(a, u, T)\<in>?S. a ## u \<and>  |a|  \<succeq>  |u|  \<and> mono_transformer T \<and> a \<succeq>  |T ?f| )
(a', u', T) \<in> S

goal (1 subgoal):
 1. mono_transformer T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
mono_transformer T

goal (1 subgoal):
 1. T f \<ominus> T unit = T f
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
mono_transformer T
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
mono_transformer T

goal (1 subgoal):
 1. T f \<ominus> T unit = T f
[PROOF STEP]
by (metis commutative minus_default minus_equiv_def mono_transformer_def option.sel unit_neutral)
[PROOF STATE]
proof (state)
this:
T f \<ominus> T unit = T f

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
T f \<ominus> T unit = T f

goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow>  |?f1.0 a u T|  \<succeq>  |a|  \<and> Some a = ?f1.0 a u T \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> ?f1.0 a u T)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
T f \<ominus> T unit = T f
[PROOF STEP]
have "sat A (the ( |a|  \<oplus> a))"
[PROOF STATE]
proof (prove)
using this:
T f \<ominus> T unit = T f

goal (1 subgoal):
 1. sat A (the ( |a|  \<oplus> a))
[PROOF STEP]
by (metis assms(1) calculation(1) calculation(2) commutative core_is_smaller option.sel)
[PROOF STATE]
proof (state)
this:
sat A (the ( |a|  \<oplus> a))

goal (1 subgoal):
 1. \<And>a u T. (a, u, T) \<in> S' \<Longrightarrow>  |?f1.0 a u T|  \<succeq>  |a|  \<and> Some a = ?f1.0 a u T \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> ?f1.0 a u T)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
sat A (the ( |a|  \<oplus> a))
[PROOF STEP]
show "|a|  \<succeq>  |a|  \<and> Some a = a \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> a)))"
[PROOF STATE]
proof (prove)
using this:
sat A (the ( |a|  \<oplus> a))

goal (1 subgoal):
 1.  |a|  \<succeq>  |a|  \<and> Some a = a \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> a)))
[PROOF STEP]
by (simp add: succ_refl unit_neutral)
[PROOF STATE]
proof (state)
this:
 |a|  \<succeq>  |a|  \<and> Some a = a \<oplus> unit \<and> (True \<longrightarrow> sat A (the ( |a|  \<oplus> a)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S'' \<and> (\<forall>(a', u', T)\<in>S''. \<exists>a u. (a, u, T) \<in> S' \<and> a' \<succeq> unit \<and>  |a'|  =  |a| )

goal (1 subgoal):
 1. \<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S'' \<and> (\<forall>(a', u', T)\<in>S''. \<exists>a u. (a, u, T) \<in> S' \<and> a' \<succeq> unit \<and>  |a'|  =  |a| )
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S'' \<and> (\<forall>(a', u', T)\<in>S''. \<exists>a u. (a, u, T) \<in> S' \<and> a' \<succeq> unit \<and>  |a'|  =  |a| )

goal (1 subgoal):
 1. \<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''

goal (1 subgoal):
 1. \<exists>S'. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''
[PROOF STEP]
obtain S'' where "package_rhs \<phi>' f S' ?pc A \<phi>' f S''"
[PROOF STATE]
proof (prove)
using this:
\<exists>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''

goal (1 subgoal):
 1. (\<And>S''. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S'' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''

goal (1 subgoal):
 1. \<exists>S'. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S'
[PROOF STEP]
have "package_rhs \<phi> unit S ?pc A \<phi>' f S''"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S''
[PROOF STEP]
using assms(2)
[PROOF STATE]
proof (prove)
using this:
Some \<phi> = \<phi>' \<oplus> f

goal (1 subgoal):
 1. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S''
[PROOF STEP]
proof (rule package_rhs.AddFromOutside)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. package_rhs \<phi>' ?f' ?S' (\<lambda>_. True) A \<phi>' f S''
 2. stable f
 3. Some ?f' = unit \<oplus> f
 4. ?S' = {uu_. \<exists>a u T r. uu_ = (r, u, T) \<and> (a, u, T) \<in> S \<and> Some r = a \<oplus> (T ?f' \<ominus> T unit) \<and> r ## u}
[PROOF STEP]
show "package_rhs \<phi>' f S' ?pc A \<phi>' f S''"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''
[PROOF STEP]
by (simp add: \<open>package_rhs \<phi>' f S' ?pc A \<phi>' f S''\<close>)
[PROOF STATE]
proof (state)
this:
package_rhs \<phi>' f S' (\<lambda>_. True) A \<phi>' f S''

goal (3 subgoals):
 1. stable f
 2. Some f = unit \<oplus> f
 3. S' = {uu_. \<exists>a u T r. uu_ = (r, u, T) \<and> (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u}
[PROOF STEP]
show "stable f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. stable f
[PROOF STEP]
using assms(3)
[PROOF STATE]
proof (prove)
using this:
stable f

goal (1 subgoal):
 1. stable f
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
stable f

goal (2 subgoals):
 1. Some f = unit \<oplus> f
 2. S' = {uu_. \<exists>a u T r. uu_ = (r, u, T) \<and> (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u}
[PROOF STEP]
show "Some f = unit \<oplus> f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Some f = unit \<oplus> f
[PROOF STEP]
by (simp add: commutative unit_neutral)
[PROOF STATE]
proof (state)
this:
Some f = unit \<oplus> f

goal (1 subgoal):
 1. S' = {uu_. \<exists>a u T r. uu_ = (r, u, T) \<and> (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u}
[PROOF STEP]
show "S' = { (r, u, T) |a u T r. (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. S' = {uu_. \<exists>a u T r. uu_ = (r, u, T) \<and> (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u}
[PROOF STEP]
using S'_def
[PROOF STATE]
proof (prove)
using this:
S' = {uu_. \<exists>a u T r. uu_ = (r, u, T) \<and> (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u}

goal (1 subgoal):
 1. S' = {uu_. \<exists>a u T r. uu_ = (r, u, T) \<and> (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
S' = {uu_. \<exists>a u T r. uu_ = (r, u, T) \<and> (a, u, T) \<in> S \<and> Some r = a \<oplus> (T f \<ominus> T unit) \<and> r ## u}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S''

goal (1 subgoal):
 1. \<exists>S'. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S''
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S''

goal (1 subgoal):
 1. \<exists>S'. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>S'. package_rhs \<phi> unit S (\<lambda>_. True) A \<phi>' f S'

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma residualFreshChainSimp[simp]:
  fixes xvec :: "name list"
  and   X    :: "name set"
  and   M    :: "'a::fs_name"
  and   N    :: 'a
  and   yvec :: "name list"
  and   P    :: "('a, 'b::fs_name, 'c::fs_name) psi"

  shows "xvec \<sharp>* (M\<lparr>N\<rparr> \<prec> P) = (xvec \<sharp>* M \<and> xvec \<sharp>* N \<and> xvec \<sharp>* P)"
  and   "xvec \<sharp>* (M\<lparr>\<nu>*yvec\<rparr>\<langle>N\<rangle> \<prec> P) = (xvec \<sharp>* M \<and> xvec \<sharp>* (\<lparr>\<nu>*yvec\<rparr>(N \<prec>' P)))"
  and   "xvec \<sharp>* (\<tau> \<prec> P) = (xvec \<sharp>* P)"
  and   "X \<sharp>* (M\<lparr>N\<rparr> \<prec> P) = (X \<sharp>* M \<and> X \<sharp>* N \<and> X \<sharp>* P)"
  and   "X \<sharp>* (M\<lparr>\<nu>*yvec\<rparr>\<langle>N\<rangle> \<prec> P) = (X \<sharp>* M \<and> X \<sharp>* (\<lparr>\<nu>*yvec\<rparr>(N \<prec>' P)))"
  and   "X \<sharp>* (\<tau> \<prec> P) = (X \<sharp>* P)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (xvec \<sharp>* (M\<lparr>N\<rparr> \<prec> P) = (xvec \<sharp>* M \<and> xvec \<sharp>* N \<and> xvec \<sharp>* P) &&& xvec \<sharp>* (M\<lparr>\<nu>*yvec\<rparr>\<langle>N\<rangle> \<prec> P) = (xvec \<sharp>* M \<and> xvec \<sharp>* (\<lparr>\<nu>*yvec\<rparr>N \<prec>' P)) &&& xvec \<sharp>* (\<tau> \<prec> P) = xvec \<sharp>* P) &&& X \<sharp>* (M\<lparr>N\<rparr> \<prec> P) = (X \<sharp>* M \<and> X \<sharp>* N \<and> X \<sharp>* P) &&& X \<sharp>* (M\<lparr>\<nu>*yvec\<rparr>\<langle>N\<rangle> \<prec> P) = (X \<sharp>* M \<and> X \<sharp>* (\<lparr>\<nu>*yvec\<rparr>N \<prec>' P)) &&& X \<sharp>* (\<tau> \<prec> P) = X \<sharp>* P
[PROOF STEP]
by(auto simp add: fresh_star_def)


[STATEMENT]
theorem impl_model_check_correct:
    assumes R: "(sysi,sys)\<in>sa_rel"
    assumes [simp]: "sa sys" "finite ((g_E sys)\<^sup>* `` g_V0 sys)"
    shows "case impl_model_check cfg sysi \<phi> of
      None
        \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi>
    | Some None
        \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi>
    | Some (Some ri)
        \<Rightarrow> (\<exists>r. (ri,r)\<in>mce_rel
           \<and> graph_defs.is_run sys r \<and> sa_L sys o r \<notin> language_ltlc \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case impl_model_check cfg sysi \<phi> of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some ri) \<Rightarrow> \<exists>r. (ri, r) \<in> mce_rel \<and> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. case impl_model_check cfg sysi \<phi> of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some ri) \<Rightarrow> \<exists>r. (ri, r) \<in> mce_rel \<and> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>
[PROOF STEP]
note impl_model_check_refine[
      where cfg=cfg,
      param_fo,
      THEN plain_nres_relD,
      OF R IdI[of \<phi>]]
[PROOF STATE]
proof (state)
this:
RETURN (impl_model_check cfg sysi \<phi>) \<le> \<Down> (\<langle>\<langle>mce_rel\<rangle>option_rel\<rangle>option_rel) (abs_model_check TYPE('q) TYPE('igba_more) TYPE('sq) TYPE('igbg_more) sys \<phi>)

goal (1 subgoal):
 1. case impl_model_check cfg sysi \<phi> of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some ri) \<Rightarrow> \<exists>r. (ri, r) \<in> mce_rel \<and> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
RETURN (impl_model_check cfg sysi \<phi>) \<le> \<Down> (\<langle>\<langle>mce_rel\<rangle>option_rel\<rangle>option_rel) (abs_model_check TYPE('q) TYPE('igba_more) TYPE('sq) TYPE('igbg_more) sys \<phi>)

goal (1 subgoal):
 1. case impl_model_check cfg sysi \<phi> of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some ri) \<Rightarrow> \<exists>r. (ri, r) \<in> mce_rel \<and> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>
[PROOF STEP]
note abs_model_check_correct
[PROOF STATE]
proof (state)
this:
abs_model_check ?T1.0 ?T2.0 ?T3.0 ?T4.0 ?sys ?\<phi> \<le> ASSERT (sa ?sys) \<bind> (\<lambda>_. ASSERT (finite ((g_E ?sys)\<^sup>* `` g_V0 ?sys)) \<bind> (\<lambda>_. SPEC (\<lambda>res. case res of None \<Rightarrow> sa.lang ?sys \<subseteq> language_ltlc ?\<phi> | Some None \<Rightarrow> \<not> sa.lang ?sys \<subseteq> language_ltlc ?\<phi> | Some (Some r) \<Rightarrow> graph_defs.is_run ?sys r \<and> sa_L ?sys \<circ> r \<notin> language_ltlc ?\<phi>)))

goal (1 subgoal):
 1. case impl_model_check cfg sysi \<phi> of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some ri) \<Rightarrow> \<exists>r. (ri, r) \<in> mce_rel \<and> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
RETURN (impl_model_check cfg sysi \<phi>) \<le> \<Down> (\<langle>\<langle>mce_rel\<rangle>option_rel\<rangle>option_rel) (ASSERT (sa sys) \<bind> (\<lambda>_. ASSERT (finite ((g_E sys)\<^sup>* `` g_V0 sys)) \<bind> (\<lambda>_. SPEC (\<lambda>res. case res of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some r) \<Rightarrow> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>))))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
RETURN (impl_model_check cfg sysi \<phi>) \<le> \<Down> (\<langle>\<langle>mce_rel\<rangle>option_rel\<rangle>option_rel) (ASSERT (sa sys) \<bind> (\<lambda>_. ASSERT (finite ((g_E sys)\<^sup>* `` g_V0 sys)) \<bind> (\<lambda>_. SPEC (\<lambda>res. case res of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some r) \<Rightarrow> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>))))

goal (1 subgoal):
 1. case impl_model_check cfg sysi \<phi> of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some ri) \<Rightarrow> \<exists>r. (ri, r) \<in> mce_rel \<and> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>
[PROOF STEP]
apply (simp split: option.split)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. RETURN (impl_model_check cfg sysi \<phi>) \<le> \<Down> (\<langle>\<langle>mce_rel\<rangle>option_rel\<rangle>option_rel) (SPEC (case_option (sa.lang sys \<subseteq> language_ltlc \<phi>) (case_option (\<not> sa.lang sys \<subseteq> language_ltlc \<phi>) (\<lambda>r. graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>)))) \<Longrightarrow> (impl_model_check cfg sysi \<phi> = None \<longrightarrow> sa.lang sys \<subseteq> language_ltlc \<phi>) \<and> (\<forall>x2. (x2 = None \<longrightarrow> impl_model_check cfg sysi \<phi> = Some None \<longrightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi>) \<and> (\<forall>x2a. x2 = Some x2a \<longrightarrow> impl_model_check cfg sysi \<phi> = Some (Some x2a) \<longrightarrow> (\<exists>r. (x2a, r) \<in> mce_rel \<and> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>)))
[PROOF STEP]
apply (simp add: refine_pw_simps pw_le_iff)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>s'. (impl_model_check cfg sysi \<phi>, s') \<in> \<langle>\<langle>mce_rel\<rangle>option_rel\<rangle>option_rel \<and> (case s' of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some r) \<Rightarrow> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>) \<Longrightarrow> (impl_model_check cfg sysi \<phi> = None \<longrightarrow> sa.lang sys \<subseteq> language_ltlc \<phi>) \<and> (\<forall>x2. (x2 = None \<longrightarrow> impl_model_check cfg sysi \<phi> = Some None \<longrightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi>) \<and> (\<forall>x2a. x2 = Some x2a \<longrightarrow> impl_model_check cfg sysi \<phi> = Some (Some x2a) \<longrightarrow> (\<exists>r. (x2a, r) \<in> mce_rel \<and> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>)))
[PROOF STEP]
apply (auto elim!: option_relE) []
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
case impl_model_check cfg sysi \<phi> of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some ri) \<Rightarrow> \<exists>r. (ri, r) \<in> mce_rel \<and> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma uint_divmod_code [code]:
  "uint_divmod x y =
  (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y)
   else if y = 0 then (div0_uint x, mod0_uint x)
   else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y);
            r = x - q * y
        in if r \<ge> y then (q + 1, r - y) else (q, r))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
proof (cases \<open>y = 0\<close>)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. y = 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
 2. y \<noteq> 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
y = 0

goal (2 subgoals):
 1. y = 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
 2. y \<noteq> 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
y = 0

goal (2 subgoals):
 1. y = 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
 2. y \<noteq> 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
have \<open>x \<ge> 0\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> x
[PROOF STEP]
by transfer simp
[PROOF STATE]
proof (state)
this:
0 \<le> x

goal (2 subgoals):
 1. y = 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
 2. y \<noteq> 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
0 \<le> x

goal (2 subgoals):
 1. y = 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
 2. y \<noteq> 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
note wivs_overflow_uint_greater_eq_0
[PROOF STATE]
proof (state)
this:
0 < wivs_overflow_uint

goal (2 subgoals):
 1. y = 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
 2. y \<noteq> 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
y = 0
0 \<le> x
0 < wivs_overflow_uint
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
y = 0
0 \<le> x
0 < wivs_overflow_uint

goal (1 subgoal):
 1. uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
by (auto simp add: uint_divmod_def div0_uint_def mod0_uint_def not_less)
[PROOF STATE]
proof (state)
this:
uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))

goal (1 subgoal):
 1. y \<noteq> 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. y \<noteq> 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
y \<noteq> 0

goal (1 subgoal):
 1. y \<noteq> 0 \<Longrightarrow> uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
y \<noteq> 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
y \<noteq> 0

goal (1 subgoal):
 1. uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
including undefined_transfer
[PROOF STATE]
proof (prove)
using this:
y \<noteq> 0

goal (1 subgoal):
 1. uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
unfolding uint_divmod_def uint_sdiv_def div0_uint_def mod0_uint_def
      wivs_overflow_uint_def
[PROOF STATE]
proof (prove)
using this:
y \<noteq> 0

goal (1 subgoal):
 1. (if y = 0 then (undefined (div) x 0, undefined (mod) x 0) else (x div y, x mod y)) = (if push_bit (dflt_size - 1) 1 \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (undefined (div) x 0, undefined (mod) x 0) else let q = push_bit 1 (if y = 0 then undefined (div) (drop_bit 1 x) 0 else Abs_uint (Rep_uint (drop_bit 1 x) sdiv Rep_uint y)); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
apply transfer
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y x. y \<noteq> 0 \<Longrightarrow> (if y = 0 then (map_fun (map_fun Rep_uint (map_fun Rep_uint Abs_uint)) (map_fun Abs_uint (map_fun Abs_uint Rep_uint)) undefined (div) x 0, map_fun (map_fun Rep_uint (map_fun Rep_uint Abs_uint)) (map_fun Abs_uint (map_fun Abs_uint Rep_uint)) undefined (mod) x 0) else (x div y, x mod y)) = (if push_bit (dflt_size - 1) 1 \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (map_fun (map_fun Rep_uint (map_fun Rep_uint Abs_uint)) (map_fun Abs_uint (map_fun Abs_uint Rep_uint)) undefined (div) x 0, map_fun (map_fun Rep_uint (map_fun Rep_uint Abs_uint)) (map_fun Abs_uint (map_fun Abs_uint Rep_uint)) undefined (mod) x 0) else let q = push_bit 1 (if y = 0 then map_fun (map_fun Rep_uint (map_fun Rep_uint Abs_uint)) (map_fun Abs_uint (map_fun Abs_uint Rep_uint)) undefined (div) (drop_bit 1 x) 0 else drop_bit 1 x sdiv y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))
[PROOF STEP]
apply (simp add: divmod_via_sdivmod push_bit_of_1)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
uint_divmod x y = (if wivs_overflow_uint \<le> y then if x < y then (0, x) else (1, x - y) else if y = 0 then (div0_uint x, mod0_uint x) else let q = push_bit 1 (uint_sdiv (drop_bit 1 x) y); r = x - q * y in if y \<le> r then (q + 1, r - y) else (q, r))

goal:
No subgoals!
[PROOF STEP]
qed