[STATEMENT]
lemma primerec_rec_pi_1[intro]:  "primerec rec_pi (Suc 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. primerec rec_pi (Suc 0)
[PROOF STEP]
apply(simp add: rec_pi_def rec_dummy_pi_def
      rec_np_def rec_fac_def rec_prime_def
      rec_Minr.simps Let_def get_fstn_args.simps
      arity.simps
      rec_all.simps rec_sigma.simps rec_accum.simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. primerec (Cn (Suc 0) (Pr (Suc 0) (constn (Suc (Suc 0))) (Cn (Suc (Suc (Suc 0))) (Cn (Suc 0) (Pr (Suc 0) (Cn (Suc 0) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_not [Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_conj [Cn (Suc (Suc 0)) rec_less [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0)], Cn (Suc (Suc 0)) (Cn (Suc 0) rec_conj [Cn (Suc 0) rec_less [constn (Suc 0), recf.id (Suc 0) 0], Cn (Suc 0) rec_sg [Cn (Suc 0) (Pr (Suc 0) (Cn (Suc 0) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc 0) 0, Cn (Suc 0) (constn 0) [recf.id (Suc 0) 0]]) (Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0)), Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc (Suc (Suc 0))) 0, Cn (Suc (Suc (Suc 0))) s [recf.id (Suc (Suc (Suc 0))) (Suc 0)]]])) [recf.id (Suc 0) 0, Cn (Suc 0) rec_minus [recf.id (Suc 0) 0, constn (Suc 0)]]]]) [recf.id (Suc (Suc 0)) (Suc 0)]]) [recf.id (Suc (Suc (Suc 0))) 0, recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))]]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_not [Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_conj [Cn (Suc (Suc 0)) rec_less [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0)], Cn (Suc (Suc 0)) (Cn (Suc 0) rec_conj [Cn (Suc 0) rec_less [constn (Suc 0), recf.id (Suc 0) 0], Cn (Suc 0) rec_sg [Cn (Suc 0) (Pr (Suc 0) (Cn (Suc 0) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc 0) 0, Cn (Suc 0) (constn 0) [recf.id (Suc 0) 0]]) (Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0)), Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc (Suc (Suc 0))) 0, Cn (Suc (Suc (Suc 0))) s [recf.id (Suc (Suc (Suc 0))) (Suc 0)]]])) [recf.id (Suc 0) 0, Cn (Suc 0) rec_minus [recf.id (Suc 0) 0, constn (Suc 0)]]]]) [recf.id (Suc (Suc 0)) (Suc 0)]]) [recf.id (Suc (Suc (Suc 0))) 0, recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))]]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), recf.id (Suc (Suc 0)) (Suc 0)]]) [recf.id (Suc 0) 0, Cn (Suc 0) (constn 0) [recf.id (Suc 0) 0]]) (Cn (Suc (Suc (Suc 0))) rec_add [recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0)), Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_not [Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_conj [Cn (Suc (Suc 0)) rec_less [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0)], Cn (Suc (Suc 0)) (Cn (Suc 0) rec_conj [Cn (Suc 0) rec_less [constn (Suc 0), recf.id (Suc 0) 0], Cn (Suc 0) rec_sg [Cn (Suc 0) (Pr (Suc 0) (Cn (Suc 0) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc 0) 0, Cn (Suc 0) (constn 0) [recf.id (Suc 0) 0]]) (Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0)), Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc (Suc (Suc 0))) 0, Cn (Suc (Suc (Suc 0))) s [recf.id (Suc (Suc (Suc 0))) (Suc 0)]]])) [recf.id (Suc 0) 0, Cn (Suc 0) rec_minus [recf.id (Suc 0) 0, constn (Suc 0)]]]]) [recf.id (Suc (Suc 0)) (Suc 0)]]) [recf.id (Suc (Suc (Suc 0))) 0, recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))]]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_not [Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_conj [Cn (Suc (Suc 0)) rec_less [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0)], Cn (Suc (Suc 0)) (Cn (Suc 0) rec_conj [Cn (Suc 0) rec_less [constn (Suc 0), recf.id (Suc 0) 0], Cn (Suc 0) rec_sg [Cn (Suc 0) (Pr (Suc 0) (Cn (Suc 0) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc 0) 0, Cn (Suc 0) (constn 0) [recf.id (Suc 0) 0]]) (Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0)), Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc (Suc (Suc 0))) 0, Cn (Suc (Suc (Suc 0))) s [recf.id (Suc (Suc (Suc 0))) (Suc 0)]]])) [recf.id (Suc 0) 0, Cn (Suc 0) rec_minus [recf.id (Suc 0) 0, constn (Suc 0)]]]]) [recf.id (Suc (Suc 0)) (Suc 0)]]) [recf.id (Suc (Suc (Suc 0))) 0, recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))]]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), recf.id (Suc (Suc 0)) (Suc 0)]]) [recf.id (Suc (Suc (Suc 0))) 0, Cn (Suc (Suc (Suc 0))) s [recf.id (Suc (Suc (Suc 0))) (Suc 0)]]])) [recf.id (Suc 0) 0, Cn (Suc 0) s [Cn (Suc 0) rec_dummyfac [recf.id (Suc 0) 0, recf.id (Suc 0) 0]]]) [recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))])) [recf.id (Suc 0) 0, recf.id (Suc 0) 0]) (Suc 0)
[PROOF STEP]
apply(tactic \<open>resolve_tac @{context} [@{thm prime_cn},  @{thm prime_pr}] 1\<close>
      ;(simp add:primerec_rec_pi_helpers primrec_dummyfac)?)+
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<forall>i<Suc (Suc 0). primerec ([Cn (Suc (Suc 0)) rec_less [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0)], Cn (Suc (Suc 0)) (Cn (Suc 0) rec_conj [Cn (Suc 0) rec_less [constn (Suc 0), recf.id (Suc 0) 0], Cn (Suc 0) rec_sg [Cn (Suc 0) (Pr (Suc 0) (Cn (Suc 0) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc 0) 0, Cn (Suc 0) (constn 0) [recf.id (Suc 0) 0]]) (Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0)), Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc (Suc (Suc 0))) 0, Cn (Suc (Suc (Suc 0))) s [recf.id (Suc (Suc (Suc 0))) (Suc 0)]]])) [recf.id (Suc 0) 0, Cn (Suc 0) rec_minus [recf.id (Suc 0) 0, constn (Suc 0)]]]]) [recf.id (Suc (Suc 0)) (Suc 0)]] ! i) (Suc (Suc 0))
 2. \<forall>i<Suc (Suc 0). primerec ([recf.id (Suc (Suc (Suc 0))) 0, recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))] ! i) (Suc (Suc (Suc 0)))
 3. \<forall>i<Suc (Suc (Suc 0)). primerec ([recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]] ! i) (Suc (Suc 0))
 4. primerec (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_not [Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_conj [Cn (Suc (Suc 0)) rec_less [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0)], Cn (Suc (Suc 0)) (Cn (Suc 0) rec_conj [Cn (Suc 0) rec_less [constn (Suc 0), recf.id (Suc 0) 0], Cn (Suc 0) rec_sg [Cn (Suc 0) (Pr (Suc 0) (Cn (Suc 0) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc 0) 0, Cn (Suc 0) (constn 0) [recf.id (Suc 0) 0]]) (Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0)), Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc (Suc (Suc 0))) 0, Cn (Suc (Suc (Suc 0))) s [recf.id (Suc (Suc (Suc 0))) (Suc 0)]]])) [recf.id (Suc 0) 0, Cn (Suc 0) rec_minus [recf.id (Suc 0) 0, constn (Suc 0)]]]]) [recf.id (Suc (Suc 0)) (Suc 0)]]) [recf.id (Suc (Suc (Suc 0))) 0, recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))]]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]]) (Suc (Suc (Suc (Suc 0))))
 5. \<forall>i<Suc (Suc (Suc 0)). primerec ([recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), recf.id (Suc (Suc 0)) (Suc 0)] ! i) (Suc (Suc 0))
 6. \<forall>i<Suc (Suc 0). primerec ([recf.id (Suc 0) 0, Cn (Suc 0) (constn 0) [recf.id (Suc 0) 0]] ! i) (Suc 0)
 7. primerec (Cn (Suc (Suc (Suc 0))) rec_add [recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0)), Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_not [Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_conj [Cn (Suc (Suc 0)) rec_less [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0)], Cn (Suc (Suc 0)) (Cn (Suc 0) rec_conj [Cn (Suc 0) rec_less [constn (Suc 0), recf.id (Suc 0) 0], Cn (Suc 0) rec_sg [Cn (Suc 0) (Pr (Suc 0) (Cn (Suc 0) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc 0) 0, Cn (Suc 0) (constn 0) [recf.id (Suc 0) 0]]) (Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0)), Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc (Suc (Suc 0))) 0, Cn (Suc (Suc (Suc 0))) s [recf.id (Suc (Suc (Suc 0))) (Suc 0)]]])) [recf.id (Suc 0) 0, Cn (Suc 0) rec_minus [recf.id (Suc 0) 0, constn (Suc 0)]]]]) [recf.id (Suc (Suc 0)) (Suc 0)]]) [recf.id (Suc (Suc (Suc 0))) 0, recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))]]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_not [Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_conj [Cn (Suc (Suc 0)) rec_less [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0)], Cn (Suc (Suc 0)) (Cn (Suc 0) rec_conj [Cn (Suc 0) rec_less [constn (Suc 0), recf.id (Suc 0) 0], Cn (Suc 0) rec_sg [Cn (Suc 0) (Pr (Suc 0) (Cn (Suc 0) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc 0) 0, Cn (Suc 0) (constn 0) [recf.id (Suc 0) 0]]) (Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0)), Cn (Suc (Suc (Suc 0))) (Cn (Suc (Suc 0)) rec_sg [Cn (Suc (Suc 0)) (Pr (Suc (Suc 0)) (Cn (Suc (Suc 0)) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) (constn 0) [recf.id (Suc (Suc 0)) 0]]) (Cn (Suc (Suc (Suc (Suc 0)))) rec_mult [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc (Suc 0))), Cn (Suc (Suc (Suc (Suc 0)))) (Cn (Suc (Suc (Suc 0))) rec_noteq [Cn (Suc (Suc (Suc 0))) rec_mult [recf.id (Suc (Suc (Suc 0))) (Suc 0), recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))], recf.id (Suc (Suc (Suc 0))) 0]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), Cn (Suc (Suc 0)) rec_minus [recf.id (Suc (Suc 0)) 0, Cn (Suc (Suc 0)) (constn (Suc 0)) [recf.id (Suc (Suc 0)) 0]]]]) [recf.id (Suc (Suc (Suc 0))) 0, Cn (Suc (Suc (Suc 0))) s [recf.id (Suc (Suc (Suc 0))) (Suc 0)]]])) [recf.id (Suc 0) 0, Cn (Suc 0) rec_minus [recf.id (Suc 0) 0, constn (Suc 0)]]]]) [recf.id (Suc (Suc 0)) (Suc 0)]]) [recf.id (Suc (Suc (Suc 0))) 0, recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))]]) [recf.id (Suc (Suc (Suc (Suc 0)))) 0, recf.id (Suc (Suc (Suc (Suc 0)))) (Suc 0), Cn (Suc (Suc (Suc (Suc 0)))) s [recf.id (Suc (Suc (Suc (Suc 0)))) (Suc (Suc 0))]]])) [recf.id (Suc (Suc 0)) 0, recf.id (Suc (Suc 0)) (Suc 0), recf.id (Suc (Suc 0)) (Suc 0)]]) [recf.id (Suc (Suc (Suc 0))) 0, Cn (Suc (Suc (Suc 0))) s [recf.id (Suc (Suc (Suc 0))) (Suc 0)]]]) (Suc (Suc (Suc 0)))
 8. primerec (recf.id (Suc (Suc (Suc 0))) (Suc (Suc 0))) (Suc (Suc (Suc 0)))
[PROOF STEP]
by fastforce+


[STATEMENT]
lemma "conucleus f \<Longrightarrow> f \<top> = \<top>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. conucleus f \<Longrightarrow> top_pres f
[PROOF STEP]
(*nitpick*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. conucleus f \<Longrightarrow> top_pres f
[PROOF STEP]
oops


[STATEMENT]
lemma l2_step3_refines_step3:
  "{R12s \<inter> UNIV \<times> (l2_inv1 \<inter> l2_inv3 \<inter> l2_inv7)}
      l1_step3 Ra A B K, l2_step3 Ra A B K
   {>R12s}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {R12s \<inter> UNIV \<times> (l2_inv1 \<inter> l2_inv3 \<inter> l2_inv7)} l1_step3 Ra A B K, l2_step3 Ra A B K {> R12s}
[PROOF STEP]
supply [[simproc del: defined_all]]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {R12s \<inter> UNIV \<times> (l2_inv1 \<inter> l2_inv3 \<inter> l2_inv7)} l1_step3 Ra A B K, l2_step3 Ra A B K {> R12s}
[PROOF STEP]
apply (auto simp add: PO_rhoare_defs R12s_defs l1_step3_def, simp_all add: l2_step3_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>b y. \<lbrakk>y \<in> l2_inv1; y \<in> l2_inv3; y \<in> l2_inv7; guessed_runs Ra = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> progress y Ra = Some {xpkE, xskE} \<and> guessed_frame Ra xsk = Some K \<and> Auth B A (Aenc K (epubKF (Ra $ kE))) \<in> chan y \<and> b = y\<lparr>progress := progress y(Ra \<mapsto> {xpkE, xskE, xsk}), l1_state.signals := (l1_state.signals y)(Commit A B \<langle>epubKF (Ra $ kE), K\<rangle> := Suc (l1_state.signals y (Commit A B \<langle>epubKF (Ra $ kE), K\<rangle>))), secret := {x. x = K \<and> Ra = test} \<union> secret y\<rparr>; can_signal y A B\<rbrakk> \<Longrightarrow> \<exists>Rb. guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr> \<and> progress y Rb = Some {xpkE, xsk} \<and> guessed_frame Rb xpkE = Some (epubKF (Ra $ kE)) \<and> guessed_frame Rb xsk = Some K
 2. \<And>b y. \<lbrakk>Ra = test; K \<in> synth (analz (ik y)); y \<in> l2_inv1; y \<in> l2_inv3; y \<in> l2_inv7; can_signal y A B; guessed_runs test = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> progress y test = Some {xpkE, xskE} \<and> guessed_frame test xsk = Some K \<and> Auth B A (Aenc K (epubKF (test $ kE))) \<in> chan y \<and> b = y\<lparr>progress := progress y(test \<mapsto> {xpkE, xskE, xsk}), l1_state.signals := (l1_state.signals y)(Commit A B \<langle>epubKF (test $ kE), K\<rangle> := Suc (l1_state.signals y (Commit A B \<langle>epubKF (test $ kE), K\<rangle>))), secret := insert K (secret y)\<rparr>\<rbrakk> \<Longrightarrow> False
 3. \<And>b y. \<lbrakk>Ra = test; K \<in> synth (analz (ik y)); y \<in> l2_inv1; y \<in> l2_inv3; y \<in> l2_inv7; \<not> can_signal y A B; guessed_runs test = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> progress y test = Some {xpkE, xskE} \<and> guessed_frame test xsk = Some K \<and> Auth B A (Aenc K (epubKF (test $ kE))) \<in> chan y \<and> b = y\<lparr>progress := progress y(test \<mapsto> {xpkE, xskE, xsk}), secret := insert K (secret y)\<rparr>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (auto dest!: l2_inv3D l2_inv7_aux intro:l2_step3_partners)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>y. \<lbrakk>Ra = test; K \<in> synth (analz (ik y)); y \<in> l2_inv1; y \<in> l2_inv3; y \<in> l2_inv7; \<not> can_signal y A B; guessed_runs test = \<lparr>role = Init, owner = A, partner = B\<rparr>; progress y test = Some {xpkE, xskE}; guessed_frame test xsk = Some K; A \<in> bad y\<rbrakk> \<Longrightarrow> False
 2. \<And>y. \<lbrakk>Ra = test; K \<in> synth (analz (ik y)); y \<in> l2_inv1; y \<in> l2_inv3; y \<in> l2_inv7; \<not> can_signal y A B; guessed_runs test = \<lparr>role = Init, owner = A, partner = B\<rparr>; progress y test = Some {xpkE, xskE}; guessed_frame test xsk = Some K; B \<in> bad y\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (auto simp add: can_signal_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma con_comp_secure_aux [rule_format]:
  assumes
    A: "secure P I D" and
    B: "Y \<subseteq> range p"
  shows "set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow>
    (map (inv p) [x\<leftarrow>xs @ ys. x \<in> range p], inv p ` Y) \<in> failures P \<longrightarrow>
    (map (inv p) [x\<leftarrow>xs. x \<in> range p] @
     map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q)
       (\<lambda>x. x \<in> range p) U ys),
     inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q)
       (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P
[PROOF STEP]
proof (induction ys arbitrary: xs U, (rule_tac [!] impI)+, simp)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>xs U. \<lbrakk>U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y) \<in> failures P
 2. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
fix xs U
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>xs U. \<lbrakk>U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y) \<in> failures P
 2. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
assume "(map (inv p) [x\<leftarrow>xs. x \<in> range p], inv p ` Y) \<in> failures P"
[PROOF STATE]
proof (state)
this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` Y) \<in> failures P

goal (2 subgoals):
 1. \<And>xs U. \<lbrakk>U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y) \<in> failures P
 2. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` Y) \<in> failures P

goal (2 subgoals):
 1. \<And>xs U. \<lbrakk>U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y) \<in> failures P
 2. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
have
   "ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y \<subseteq> Y"
    (is "?Y' \<subseteq> _")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y \<subseteq> Y
[PROOF STEP]
by (rule ipurge_ref_aux_subset)
[PROOF STATE]
proof (state)
this:
ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y \<subseteq> Y

goal (2 subgoals):
 1. \<And>xs U. \<lbrakk>U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y) \<in> failures P
 2. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
hence "inv p ` ?Y' \<subseteq> inv p ` Y"
[PROOF STATE]
proof (prove)
using this:
ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y \<subseteq> Y

goal (1 subgoal):
 1. inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y \<subseteq> inv p ` Y
[PROOF STEP]
by (rule image_mono)
[PROOF STATE]
proof (state)
this:
inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y \<subseteq> inv p ` Y

goal (2 subgoals):
 1. \<And>xs U. \<lbrakk>U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y) \<in> failures P
 2. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` Y) \<in> failures P
inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y \<subseteq> inv p ` Y
[PROOF STEP]
show "(map (inv p) [x\<leftarrow>xs. x \<in> range p], inv p ` ?Y') \<in> failures P"
[PROOF STATE]
proof (prove)
using this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` Y) \<in> failures P
inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y \<subseteq> inv p ` Y

goal (1 subgoal):
 1. (map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y) \<in> failures P
[PROOF STEP]
by (rule process_rule_3)
[PROOF STATE]
proof (state)
this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs), inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
fix y ys xs U
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
assume "\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow>
    (map (inv p) [x\<leftarrow>xs @ ys. x \<in> range p], inv p ` Y) \<in> failures P \<longrightarrow>
    (map (inv p) [x\<leftarrow>xs. x \<in> range p] @
     map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q)
       (\<lambda>x. x \<in> range p) U ys),
     inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q)
       (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P"
[PROOF STATE]
proof (state)
this:
set ys \<subseteq> range p \<union> range q \<longrightarrow> ?U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (?xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ?xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) ?U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) ?U ys Y) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
hence "set ys \<subseteq> range p \<union> range q \<longrightarrow>
    sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some \<longrightarrow>
    (map (inv p) [x\<leftarrow>(xs @ [y]) @ ys. x \<in> range p], inv p ` Y) \<in> failures P \<longrightarrow>
    (map (inv p) [x\<leftarrow>xs @ [y]. x \<in> range p] @
     map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q)
       (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q)
         U [y]) ys),
     inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q)
       (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q)
         U [y]) ys Y) \<in> failures P"
    (is "_ \<longrightarrow> _ \<longrightarrow> _ \<longrightarrow>
      (_ @ map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F ?U' _), _) \<in> _")
[PROOF STATE]
proof (prove)
using this:
set ys \<subseteq> range p \<union> range q \<longrightarrow> ?U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (?xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ?xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) ?U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) ?U ys Y) \<in> failures P

goal (1 subgoal):
 1. set ys \<subseteq> range p \<union> range q \<longrightarrow> sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
set ys \<subseteq> range p \<union> range q \<longrightarrow> sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
set ys \<subseteq> range p \<union> range q \<longrightarrow> sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
assume C: "set (y # ys) \<subseteq> range p \<union> range q"
[PROOF STATE]
proof (state)
this:
set (y # ys) \<subseteq> range p \<union> range q

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
hence "set ys \<subseteq> range p \<union> range q"
[PROOF STATE]
proof (prove)
using this:
set (y # ys) \<subseteq> range p \<union> range q

goal (1 subgoal):
 1. set ys \<subseteq> range p \<union> range q
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
set ys \<subseteq> range p \<union> range q

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
set ys \<subseteq> range p \<union> range q \<longrightarrow> sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
set ys \<subseteq> range p \<union> range q
[PROOF STEP]
have "?U' \<subseteq> range Some \<longrightarrow>
    (map (inv p) [x\<leftarrow>(xs @ [y]) @ ys. x \<in> range p], inv p ` Y) \<in> failures P \<longrightarrow>
    (map (inv p) [x\<leftarrow>xs @ [y]. x \<in> range p] @
     map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys),
     inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y) \<in> failures P"
[PROOF STATE]
proof (prove)
using this:
set ys \<subseteq> range p \<union> range q \<longrightarrow> sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
set ys \<subseteq> range p \<union> range q

goal (1 subgoal):
 1. sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
assume D: "U \<subseteq> range Some"
[PROOF STATE]
proof (state)
this:
U \<subseteq> range Some

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
hence "?U' \<subseteq> range Some"
[PROOF STATE]
proof (prove)
using this:
U \<subseteq> range Some

goal (1 subgoal):
 1. sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some
[PROOF STEP]
proof (cases "\<exists>u \<in> U. (u, ?D' y) \<in> ?I'", simp_all add: sinks_aux_single_event)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>\<exists>u\<in>U. (u, con_comp_map D E p q y) \<in> con_comp_pol I; U \<subseteq> range Some\<rbrakk> \<Longrightarrow> con_comp_map D E p q y \<in> range Some
[PROOF STEP]
have "y \<in> range p \<union> range q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<in> range p \<union> range q
[PROOF STEP]
using C
[PROOF STATE]
proof (prove)
using this:
set (y # ys) \<subseteq> range p \<union> range q

goal (1 subgoal):
 1. y \<in> range p \<union> range q
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
y \<in> range p \<union> range q

goal (1 subgoal):
 1. \<lbrakk>\<exists>u\<in>U. (u, con_comp_map D E p q y) \<in> con_comp_pol I; U \<subseteq> range Some\<rbrakk> \<Longrightarrow> con_comp_map D E p q y \<in> range Some
[PROOF STEP]
thus "?D' y \<in> range Some"
[PROOF STATE]
proof (prove)
using this:
y \<in> range p \<union> range q

goal (1 subgoal):
 1. con_comp_map D E p q y \<in> range Some
[PROOF STEP]
by (cases "y \<in> range p", simp_all)
[PROOF STATE]
proof (state)
this:
con_comp_map D E p q y \<in> range Some

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some
[PROOF STEP]
have
   "(map (inv p) [x\<leftarrow>(xs @ [y]) @ ys. x \<in> range p], inv p ` Y) \<in> failures P \<longrightarrow>
    (map (inv p) [x\<leftarrow>xs @ [y]. x \<in> range p] @
     map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys),
     inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y) \<in> failures P"
[PROOF STATE]
proof (prove)
using this:
sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \<subseteq> range Some

goal (1 subgoal):
 1. (map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
assume
   "(map (inv p) [x\<leftarrow>xs @ y # ys. x \<in> range p], inv p ` Y) \<in> failures P"
[PROOF STATE]
proof (state)
this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ y # ys)), inv p ` Y) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
(map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ y # ys)), inv p ` Y) \<in> failures P
[PROOF STEP]
have
   "(map (inv p) [x\<leftarrow>xs @ [y]. x \<in> range p] @
     map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys),
     inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y) \<in> failures P"
[PROOF STATE]
proof (prove)
using this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) ((xs @ [y]) @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
(map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ y # ys)), inv p ` Y) \<in> failures P

goal (1 subgoal):
 1. (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
hence
   "(map (inv p) [x\<leftarrow>xs. x \<in> range p] @
     map (inv p) ((if y \<in> range p then [y] else []) @
       ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys),
     inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y) \<in> failures P"
[PROOF STATE]
proof (prove)
using this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ [y])) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P

goal (1 subgoal):
 1. (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
[PROOF STEP]
by (cases "y \<in> range p", simp_all)
[PROOF STATE]
proof (state)
this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
with A
[PROOF STATE]
proof (chain)
picking this:
secure P I D
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P
[PROOF STEP]
have
   "(map (inv p) [x\<leftarrow>xs. x \<in> range p] @
     ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @
       ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys)),
     ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @
       ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys))
     (inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y)) \<in> failures P"
[PROOF STATE]
proof (prove)
using this:
secure P I D
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) \<in> failures P

goal (1 subgoal):
 1. (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)), ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) (inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y)) \<in> failures P
[PROOF STEP]
by (rule ipurge_tr_ref_aux_failures_general)
[PROOF STATE]
proof (state)
this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)), ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) (inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y)) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)), ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) (inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y)) \<in> failures P

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
have
   "ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @
      ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys)) =
    map (inv p) (ipurge_tr_aux ?I' ?D' U ((if y \<in> range p then [y] else []) @
      ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) = map (inv p) (ipurge_tr_aux (con_comp_pol I) (con_comp_map D E p q) U ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys))
[PROOF STEP]
by (rule con_comp_ipurge_tr_aux, simp_all add:
    D ipurge_tr_aux_foldr_eq [symmetric], blast)
[PROOF STATE]
proof (state)
this:
ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) = map (inv p) (ipurge_tr_aux (con_comp_pol I) (con_comp_map D E p q) U ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys))

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) = map (inv p) (ipurge_tr_aux (con_comp_pol I) (con_comp_map D E p q) U ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys))

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
have
   "ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @
      ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys))
      (inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y) =
    inv p ` ipurge_ref_aux ?I' ?D' U ((if y \<in> range p then [y] else []) @
      ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys)
      (ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) (inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) = inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys) (ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y)
[PROOF STEP]
proof (rule con_comp_ipurge_ref_aux, simp_all add:
   D ipurge_tr_aux_foldr_eq [symmetric] ipurge_ref_aux_foldr_eq [symmetric], blast)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y \<subseteq> range p
[PROOF STEP]
have "ipurge_ref_aux ?I' ?D' ?U' ys Y \<subseteq> Y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y \<subseteq> Y
[PROOF STEP]
by (rule ipurge_ref_aux_subset)
[PROOF STATE]
proof (state)
this:
ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y \<subseteq> Y

goal (1 subgoal):
 1. ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y \<subseteq> range p
[PROOF STEP]
thus "ipurge_ref_aux ?I' ?D' ?U' ys Y \<subseteq> range p"
[PROOF STATE]
proof (prove)
using this:
ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y \<subseteq> Y

goal (1 subgoal):
 1. ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y \<subseteq> range p
[PROOF STEP]
using B
[PROOF STATE]
proof (prove)
using this:
ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y \<subseteq> Y
Y \<subseteq> range p

goal (1 subgoal):
 1. ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y \<subseteq> range p
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y \<subseteq> range p

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) (inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) = inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys) (ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y)

goal (1 subgoal):
 1. \<And>a ys xs U. \<lbrakk>\<And>xs U. set ys \<subseteq> range p \<union> range q \<longrightarrow> U \<subseteq> range Some \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ ys)), inv p ` Y) \<in> failures P \<longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U ys Y) \<in> failures P; set (a # ys) \<subseteq> range p \<union> range q; U \<subseteq> range Some; (map (inv p) (filter (\<lambda>x. x \<in> range p) (xs @ a # ys)), inv p ` Y) \<in> failures P\<rbrakk> \<Longrightarrow> (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (a # ys) Y) \<in> failures P
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)), ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) (inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y)) \<in> failures P
ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) = map (inv p) (ipurge_tr_aux (con_comp_pol I) (con_comp_map D E p q) U ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys))
ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) (inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) = inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys) (ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y)
[PROOF STEP]
show
   "(map (inv p) [x\<leftarrow>xs. x \<in> range p] @
     map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F U (y # ys)),
     inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F U (y # ys) Y) \<in> failures P"
[PROOF STATE]
proof (prove)
using this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)), ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) (inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y)) \<in> failures P
ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) = map (inv p) (ipurge_tr_aux (con_comp_pol I) (con_comp_map D E p q) U ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys))
ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys)) (inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y) = inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U ((if y \<in> range p then [y] else []) @ ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys) (ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]) ys Y)

goal (1 subgoal):
 1. (map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (y # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (y # ys) Y) \<in> failures P
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(map (inv p) (filter (\<lambda>x. x \<in> range p) xs) @ map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (y # ys)), inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q) (\<lambda>x. x \<in> range p) U (y # ys) Y) \<in> failures P

goal:
No subgoals!
[PROOF STEP]
qed