[STATEMENT]
lemma dra_param[param]:
    "(dra, dra) \<in> \<langle>L\<rangle> set_rel \<rightarrow> S \<rightarrow> (L \<rightarrow> S \<rightarrow> S) \<rightarrow> \<langle>rabin_rel S\<rangle> list_rel \<rightarrow>
      \<langle>L, S\<rangle> dra_rel"
    "(alphabet, alphabet) \<in> \<langle>L, S\<rangle> dra_rel \<rightarrow> \<langle>L\<rangle> set_rel"
    "(initial, initial) \<in> \<langle>L, S\<rangle> dra_rel \<rightarrow> S"
    "(transition, transition) \<in> \<langle>L, S\<rangle> dra_rel \<rightarrow> L \<rightarrow> S \<rightarrow> S"
    "(condition, condition) \<in> \<langle>L, S\<rangle> dra_rel \<rightarrow> \<langle>rabin_rel S\<rangle> list_rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((dra, dra) \<in> \<langle>L\<rangle>set_rel \<rightarrow> S \<rightarrow> (L \<rightarrow> S \<rightarrow> S) \<rightarrow> \<langle>(S \<rightarrow> bool_rel) \<times>\<^sub>r (S \<rightarrow> bool_rel)\<rangle>list_rel \<rightarrow> \<langle>L, S\<rangle>dra_rel &&& (alphabet, alphabet) \<in> \<langle>L, S\<rangle>dra_rel \<rightarrow> \<langle>L\<rangle>set_rel) &&& (initial, initial) \<in> \<langle>L, S\<rangle>dra_rel \<rightarrow> S &&& (transition, transition) \<in> \<langle>L, S\<rangle>dra_rel \<rightarrow> L \<rightarrow> S \<rightarrow> S &&& (condition, condition) \<in> \<langle>L, S\<rangle>dra_rel \<rightarrow> \<langle>(S \<rightarrow> bool_rel) \<times>\<^sub>r (S \<rightarrow> bool_rel)\<rangle>list_rel
[PROOF STEP]
unfolding dra_rel_def fun_rel_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((dra, dra) \<in> {(f, f'). \<forall>(a, a')\<in>\<langle>L\<rangle>set_rel. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>{(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}}. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>\<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel. (f a, f' a') \<in> {(A\<^sub>1, A\<^sub>2). (alphabet A\<^sub>1, alphabet A\<^sub>2) \<in> \<langle>L\<rangle>set_rel \<and> (initial A\<^sub>1, initial A\<^sub>2) \<in> S \<and> (transition A\<^sub>1, transition A\<^sub>2) \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}} \<and> (condition A\<^sub>1, condition A\<^sub>2) \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}}}}} &&& (alphabet, alphabet) \<in> {(f, f'). \<forall>(a, a')\<in>{(A\<^sub>1, A\<^sub>2). (alphabet A\<^sub>1, alphabet A\<^sub>2) \<in> \<langle>L\<rangle>set_rel \<and> (initial A\<^sub>1, initial A\<^sub>2) \<in> S \<and> (transition A\<^sub>1, transition A\<^sub>2) \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}} \<and> (condition A\<^sub>1, condition A\<^sub>2) \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}. (f a, f' a') \<in> \<langle>L\<rangle>set_rel}) &&& (initial, initial) \<in> {(f, f'). \<forall>(a, a')\<in>{(A\<^sub>1, A\<^sub>2). (alphabet A\<^sub>1, alphabet A\<^sub>2) \<in> \<langle>L\<rangle>set_rel \<and> (initial A\<^sub>1, initial A\<^sub>2) \<in> S \<and> (transition A\<^sub>1, transition A\<^sub>2) \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}} \<and> (condition A\<^sub>1, condition A\<^sub>2) \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}. (f a, f' a') \<in> S} &&& (transition, transition) \<in> {(f, f'). \<forall>(a, a')\<in>{(A\<^sub>1, A\<^sub>2). (alphabet A\<^sub>1, alphabet A\<^sub>2) \<in> \<langle>L\<rangle>set_rel \<and> (initial A\<^sub>1, initial A\<^sub>2) \<in> S \<and> (transition A\<^sub>1, transition A\<^sub>2) \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}} \<and> (condition A\<^sub>1, condition A\<^sub>2) \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}}} &&& (condition, condition) \<in> {(f, f'). \<forall>(a, a')\<in>{(A\<^sub>1, A\<^sub>2). (alphabet A\<^sub>1, alphabet A\<^sub>2) \<in> \<langle>L\<rangle>set_rel \<and> (initial A\<^sub>1, initial A\<^sub>2) \<in> S \<and> (transition A\<^sub>1, transition A\<^sub>2) \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}} \<and> (condition A\<^sub>1, condition A\<^sub>2) \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}. (f a, f' a') \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}
[PROOF STEP]
by auto


[STATEMENT]
lemma init_fin_redT_hext_incr:
  assumes "mthr.if.redT s (t, ta) s'"
  and "ts_ok (init_fin_lift wfx) (thr s) (shr s)"
  and "non_speculative P vs (llist_of \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>)"
  and "vs_conf P (shr s) vs"
  shows "shr s \<unlhd> shr s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. shr s \<unlhd> shr s'
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
mthr.if.redT_syntax1 s t ta s'
ts_ok (init_fin_lift wfx) (thr s) (shr s)
non_speculative P vs (llist_of \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>)
vs_conf P (shr s) vs

goal (1 subgoal):
 1. shr s \<unlhd> shr s'
[PROOF STEP]
by(cases)(auto dest: init_fin_hext_incr ts_okD)


[STATEMENT]
lemma A_Issues_B:
     "\<lbrakk> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs;
        Key K \<notin> analz (spies evs);
        A \<notin> bad;  B \<notin> bad; evs \<in> ns_shared \<rbrakk>
    \<Longrightarrow> A Issues B with (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) on evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs; Key K \<notin> analz (knows Spy evs); A \<notin> bad; B \<notin> bad; evs \<in> ns_shared\<rbrakk> \<Longrightarrow> A Issues B with Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> on evs
[PROOF STEP]
apply (simp (no_asm) add: Issues_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs; Key K \<notin> analz (knows Spy evs); A \<notin> bad; B \<notin> bad; evs \<in> ns_shared\<rbrakk> \<Longrightarrow> \<exists>Y. Says A B Y \<in> set evs \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<in> parts {Y} \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B Y) (rev evs)))
[PROOF STEP]
apply (rule exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs; Key K \<notin> analz (knows Spy evs); A \<notin> bad; B \<notin> bad; evs \<in> ns_shared\<rbrakk> \<Longrightarrow> Says A B ?Y \<in> set evs \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<in> parts {?Y} \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B ?Y) (rev evs)))
[PROOF STEP]
apply (rule conjI, assumption)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs; Key K \<notin> analz (knows Spy evs); A \<notin> bad; B \<notin> bad; evs \<in> ns_shared\<rbrakk> \<Longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<in> parts {Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>} \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs)))
[PROOF STEP]
apply (simp (no_asm))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs; Key K \<notin> analz (knows Spy evs); A \<notin> bad; B \<notin> bad; evs \<in> ns_shared\<rbrakk> \<Longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs)))
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Key K \<notin> analz (knows Spy evs); A \<notin> bad; B \<notin> bad; evs \<in> ns_shared\<rbrakk> \<Longrightarrow> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs)))
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> ns_shared\<rbrakk> \<Longrightarrow> Key K \<notin> analz (knows Spy evs) \<longrightarrow> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs)))
[PROOF STEP]
apply (erule ns_shared.induct, analz_mono_contra)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<lbrakk>A \<notin> bad; B \<notin> bad\<rbrakk> \<Longrightarrow> Key K \<notin> analz (knows Spy []) \<longrightarrow> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set [] \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev [])))
 2. \<And>evsf X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evsf \<in> ns_shared; X \<in> synth (analz (knows Spy evsf)); Key K \<notin> analz (knows Spy evsf); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evsf \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evsf)))\<rbrakk> \<Longrightarrow> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set (Says Spy Ba X # evsf) \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev (Says Spy Ba X # evsf))))
 3. \<And>evs1 NA Aa Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs1 \<in> ns_shared; Nonce NA \<notin> used evs1; Key K \<notin> analz (knows Spy evs1); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs1 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs1)))\<rbrakk> \<Longrightarrow> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set (Says Aa Server \<lbrace>Agent Aa, Agent Ba, Nonce NA\<rbrace> # evs1) \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev (Says Aa Server \<lbrace>Agent Aa, Agent Ba, Nonce NA\<rbrace> # evs1))))
 4. \<And>evs2 KAB A' Aa Ba NA. \<lbrakk>A \<notin> bad; B \<notin> bad; evs2 \<in> ns_shared; Key KAB \<notin> used evs2; KAB \<in> symKeys; Says A' Server \<lbrace>Agent Aa, Agent Ba, Nonce NA\<rbrace> \<in> set evs2; Key K \<notin> analz (knows Spy evs2); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs2 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs2)))\<rbrakk> \<Longrightarrow> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set (Says Server Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key KAB, Crypt (shrK Ba) \<lbrace>Key KAB, Agent Aa\<rbrace>\<rbrace>) # evs2) \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev (Says Server Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key KAB, Crypt (shrK Ba) \<lbrace>Key KAB, Agent Aa\<rbrace>\<rbrace>) # evs2))))
 5. \<And>evs3 Aa S NA Ba Ka X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_shared; Aa \<noteq> Server; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs3; Says Aa Server \<lbrace>Agent Aa, Agent Ba, Nonce NA\<rbrace> \<in> set evs3; Key K \<notin> analz (knows Spy evs3); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs3)))\<rbrakk> \<Longrightarrow> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set (Says Aa Ba X # evs3) \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev (Says Aa Ba X # evs3))))
 6. \<And>evs4 NBa Ka A' Ba Aa. \<lbrakk>A \<notin> bad; B \<notin> bad; evs4 \<in> ns_shared; Nonce NBa \<notin> used evs4; Ka \<in> symKeys; Says A' Ba (Crypt (shrK Ba) \<lbrace>Key Ka, Agent Aa\<rbrace>) \<in> set evs4; Key K \<notin> analz (knows Spy evs4); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs4 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs4)))\<rbrakk> \<Longrightarrow> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set (Says Ba Aa (Crypt Ka (Nonce NBa)) # evs4) \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev (Says Ba Aa (Crypt Ka (Nonce NBa)) # evs4))))
 7. \<And>evs5 Ka B' Aa NBa S NA Ba X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs5 \<in> ns_shared; Ka \<in> symKeys; Says B' Aa (Crypt Ka (Nonce NBa)) \<in> set evs5; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs5; Key K \<notin> analz (knows Spy evs5); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs5 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs5)))\<rbrakk> \<Longrightarrow> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set (Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>) # evs5) \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev (Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>) # evs5))))
 8. \<And>evso Ba Aa Ka NBa NA X. \<lbrakk>A \<notin> bad; B \<notin> bad; evso \<in> ns_shared; Says Ba Aa (Crypt Ka (Nonce NBa)) \<in> set evso; Says Server Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evso; Key K \<notin> analz (knows Spy evso); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evso \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evso)))\<rbrakk> \<Longrightarrow> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set (Notes Spy \<lbrace>Nonce NA, Nonce NBa, Key Ka\<rbrace> # evso) \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev (Notes Spy \<lbrace>Nonce NA, Nonce NBa, Key Ka\<rbrace> # evso))))
[PROOF STEP]
apply (simp_all)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>evsf X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evsf \<in> ns_shared; X \<in> synth (analz (knows Spy evsf)); Key K \<notin> analz (knows Spy evsf); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evsf \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evsf)))\<rbrakk> \<Longrightarrow> A = Spy \<and> B = Ba \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> = X \<longrightarrow> X \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Spy Ba X) (rev evsf @ [Says Spy Ba X])))
 2. \<And>evs3 Aa S NA Ba Ka X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_shared; Aa \<noteq> Server; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs3; Says Aa Server \<lbrace>Agent Aa, Agent Ba, Nonce NA\<rbrace> \<in> set evs3; Key K \<notin> analz (knows Spy evs3); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs3)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> = X \<longrightarrow> X \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba X) (rev evs3 @ [Says Aa Ba X])))
 3. \<And>evs5 Ka B' Aa NBa S NA Ba X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs5 \<in> ns_shared; Ka \<in> symKeys; Says B' Aa (Crypt Ka (Nonce NBa)) \<in> set evs5; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs5; Key K \<notin> analz (knows Spy evs5); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs5 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs5)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> K = Ka \<and> NB = NBa \<longrightarrow> Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>)) (rev evs5 @ [Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>)])))
[PROOF STEP]
txt\<open>fake\<close>
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>evsf X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evsf \<in> ns_shared; X \<in> synth (analz (knows Spy evsf)); Key K \<notin> analz (knows Spy evsf); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evsf \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evsf)))\<rbrakk> \<Longrightarrow> A = Spy \<and> B = Ba \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> = X \<longrightarrow> X \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Spy Ba X) (rev evsf @ [Says Spy Ba X])))
 2. \<And>evs3 Aa S NA Ba Ka X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_shared; Aa \<noteq> Server; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs3; Says Aa Server \<lbrace>Agent Aa, Agent Ba, Nonce NA\<rbrace> \<in> set evs3; Key K \<notin> analz (knows Spy evs3); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs3)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> = X \<longrightarrow> X \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba X) (rev evs3 @ [Says Aa Ba X])))
 3. \<And>evs5 Ka B' Aa NBa S NA Ba X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs5 \<in> ns_shared; Ka \<in> symKeys; Says B' Aa (Crypt Ka (Nonce NBa)) \<in> set evs5; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs5; Key K \<notin> analz (knows Spy evs5); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs5 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs5)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> K = Ka \<and> NB = NBa \<longrightarrow> Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>)) (rev evs5 @ [Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>)])))
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evs3 Aa S NA Ba Ka X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_shared; Aa \<noteq> Server; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs3; Says Aa Server \<lbrace>Agent Aa, Agent Ba, Nonce NA\<rbrace> \<in> set evs3; Key K \<notin> analz (knows Spy evs3); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs3)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> = X \<longrightarrow> X \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba X) (rev evs3 @ [Says Aa Ba X])))
 2. \<And>evs5 Ka B' Aa NBa S NA Ba X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs5 \<in> ns_shared; Ka \<in> symKeys; Says B' Aa (Crypt Ka (Nonce NBa)) \<in> set evs5; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs5; Key K \<notin> analz (knows Spy evs5); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs5 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs5)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> K = Ka \<and> NB = NBa \<longrightarrow> Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>)) (rev evs5 @ [Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>)])))
[PROOF STEP]
apply (simp_all add: takeWhile_tail)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evs3 Aa S NA Ba Ka X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_shared; Aa \<noteq> Server; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs3; Says Aa Server \<lbrace>Agent Aa, Agent Ba, Nonce NA\<rbrace> \<in> set evs3; Key K \<notin> analz (knows Spy evs3); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs3)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> = X \<longrightarrow> X \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba X) (rev evs3)))
 2. \<And>evs5 Ka B' Aa NBa S NA Ba X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs5 \<in> ns_shared; Ka \<in> symKeys; Says B' Aa (Crypt Ka (Nonce NBa)) \<in> set evs5; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs5; Key K \<notin> analz (knows Spy evs5); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs5 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs5)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> K = Ka \<and> NB = NBa \<longrightarrow> Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>)) (rev evs5)))
[PROOF STEP]
txt\<open>NS3 remains by pure coincidence!\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evs3 Aa S NA Ba Ka X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_shared; Aa \<noteq> Server; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs3; Says Aa Server \<lbrace>Agent Aa, Agent Ba, Nonce NA\<rbrace> \<in> set evs3; Key K \<notin> analz (knows Spy evs3); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs3)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> = X \<longrightarrow> X \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba X) (rev evs3)))
 2. \<And>evs5 Ka B' Aa NBa S NA Ba X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs5 \<in> ns_shared; Ka \<in> symKeys; Says B' Aa (Crypt Ka (Nonce NBa)) \<in> set evs5; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs5; Key K \<notin> analz (knows Spy evs5); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs5 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs5)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> K = Ka \<and> NB = NBa \<longrightarrow> Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>)) (rev evs5)))
[PROOF STEP]
apply (force dest!: A_trusts_NS2 Says_Server_message_form)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs5 Ka B' Aa NBa S NA Ba X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs5 \<in> ns_shared; Ka \<in> symKeys; Says B' Aa (Crypt Ka (Nonce NBa)) \<in> set evs5; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs5; Key K \<notin> analz (knows Spy evs5); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs5 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs5)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> K = Ka \<and> NB = NBa \<longrightarrow> Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>)) (rev evs5)))
[PROOF STEP]
txt\<open>NS5 is the non-trivial case and cannot be solved as in \<^term>\<open>B_Issues_A\<close>! because NB is not fresh. We need \<^term>\<open>A_trusts_NS5\<close>, proved for this very purpose\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs5 Ka B' Aa NBa S NA Ba X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs5 \<in> ns_shared; Ka \<in> symKeys; Says B' Aa (Crypt Ka (Nonce NBa)) \<in> set evs5; Says S Aa (Crypt (shrK Aa) \<lbrace>Nonce NA, Agent Ba, Key Ka, X\<rbrace>) \<in> set evs5; Key K \<notin> analz (knows Spy evs5); Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>) \<in> set evs5 \<longrightarrow> Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says A B (Crypt K \<lbrace>Nonce NB, Nonce NB\<rbrace>)) (rev evs5)))\<rbrakk> \<Longrightarrow> A = Aa \<and> B = Ba \<and> K = Ka \<and> NB = NBa \<longrightarrow> Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace> \<notin> parts (knows Spy (takeWhile (\<lambda>z. z \<noteq> Says Aa Ba (Crypt Ka \<lbrace>Nonce NBa, Nonce NBa\<rbrace>)) (rev evs5)))
[PROOF STEP]
apply (blast dest: A_trusts_NS5 parts_spies_takeWhile_mono [THEN subsetD]
        parts_spies_evs_revD2 [THEN subsetD])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "P (Inr x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (Inr x)
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (Inr x)
[PROOF STEP]
oops


[STATEMENT]
lemma (in wf_ast_problem) wf_actions_only_add_atoms:
    "\<lbrakk> wm_basic s; wf_plan_action a \<rbrakk>
      \<Longrightarrow> wm_basic (execute_plan_action a s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wm_basic s; wf_plan_action a\<rbrakk> \<Longrightarrow> wm_basic (execute_plan_action a s)
[PROOF STEP]
using wf_problem wf_domain
[PROOF STATE]
proof (prove)
using this:
wf_problem
wf_domain

goal (1 subgoal):
 1. \<lbrakk>wm_basic s; wf_plan_action a\<rbrakk> \<Longrightarrow> wm_basic (execute_plan_action a s)
[PROOF STEP]
unfolding wf_problem_def wf_domain_def
[PROOF STATE]
proof (prove)
using this:
(wf_types \<and> distinct (map pred (predicates D)) \<and> Ball (set (predicates D)) wf_predicate_decl \<and> distinct (map fst (consts D)) \<and> (\<forall>(n, y)\<in>set (consts D). wf_type y) \<and> distinct (map ast_action_schema.name (actions D)) \<and> Ball (set (actions D)) wf_action_schema) \<and> distinct (map fst (objects P) @ map fst (consts D)) \<and> (\<forall>(n, y)\<in>set (objects P). wf_type y) \<and> distinct (init P) \<and> wf_world_model (set (init P)) \<and> wf_fmla objT (goal P)
wf_types \<and> distinct (map pred (predicates D)) \<and> Ball (set (predicates D)) wf_predicate_decl \<and> distinct (map fst (consts D)) \<and> (\<forall>(n, y)\<in>set (consts D). wf_type y) \<and> distinct (map ast_action_schema.name (actions D)) \<and> Ball (set (actions D)) wf_action_schema

goal (1 subgoal):
 1. \<lbrakk>wm_basic s; wf_plan_action a\<rbrakk> \<Longrightarrow> wm_basic (execute_plan_action a s)
[PROOF STEP]
apply (cases a)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2. \<lbrakk>wm_basic s; wf_plan_action a; (wf_types \<and> distinct (map pred (predicates D)) \<and> Ball (set (predicates D)) wf_predicate_decl \<and> distinct (map fst (consts D)) \<and> (\<forall>(n, y)\<in>set (consts D). wf_type y) \<and> distinct (map ast_action_schema.name (actions D)) \<and> Ball (set (actions D)) wf_action_schema) \<and> distinct (map fst (objects P) @ map fst (consts D)) \<and> (\<forall>(n, y)\<in>set (objects P). wf_type y) \<and> distinct (init P) \<and> wf_world_model (set (init P)) \<and> wf_fmla objT (goal P); wf_types \<and> distinct (map pred (predicates D)) \<and> Ball (set (predicates D)) wf_predicate_decl \<and> distinct (map fst (consts D)) \<and> (\<forall>(n, y)\<in>set (consts D). wf_type y) \<and> distinct (map ast_action_schema.name (actions D)) \<and> Ball (set (actions D)) wf_action_schema; a = PAction x1 x2\<rbrakk> \<Longrightarrow> wm_basic (execute_plan_action a s)
[PROOF STEP]
apply (clarsimp
      split: option.splits
      simp: wf_fmla_atom_alt execute_plan_action_def wm_basic_def
      simp: execute_ground_action_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x2a aa. \<lbrakk>a = PAction x1 x2; \<forall>a\<in>s. is_predAtom a; distinct (map fst (objects P)); wf_types; fst ` set (objects P) \<inter> fst ` set (consts D) = {}; distinct (map pred (predicates D)); \<forall>x\<in>set (objects P). case x of (n, x) \<Rightarrow> wf_type x; Ball (set (predicates D)) wf_predicate_decl; distinct (init P); distinct (map fst (consts D)); wf_world_model (set (init P)); wf_fmla objT (goal P); \<forall>x\<in>set (consts D). case x of (n, x) \<Rightarrow> wf_type x; distinct (map ast_action_schema.name (actions D)); Ball (set (actions D)) wf_action_schema; resolve_action_schema x1 = Some x2a; aa \<in> apply_effect (ground_action.effect (instantiate_action_schema x2a x2)) s; action_params_match x2a x2; wf_effect_inst (ground_action.effect (instantiate_action_schema x2a x2))\<rbrakk> \<Longrightarrow> is_predAtom aa
[PROOF STEP]
subgoal for n args schema fmla
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a = PAction n args; \<forall>a\<in>s. is_predAtom a; distinct (map fst (objects P)); wf_types; fst ` set (objects P) \<inter> fst ` set (consts D) = {}; distinct (map pred (predicates D)); \<forall>x\<in>set (objects P). case x of (n, x) \<Rightarrow> wf_type x; Ball (set (predicates D)) wf_predicate_decl; distinct (init P); distinct (map fst (consts D)); wf_world_model (set (init P)); wf_fmla objT (goal P); \<forall>x\<in>set (consts D). case x of (n, x) \<Rightarrow> wf_type x; distinct (map ast_action_schema.name (actions D)); Ball (set (actions D)) wf_action_schema; resolve_action_schema n = Some schema; fmla \<in> apply_effect (ground_action.effect (instantiate_action_schema schema args)) s; action_params_match schema args; wf_effect_inst (ground_action.effect (instantiate_action_schema schema args))\<rbrakk> \<Longrightarrow> is_predAtom fmla
[PROOF STEP]
apply (cases "effect (instantiate_action_schema schema args)"; simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2. \<lbrakk>a = PAction n args; \<forall>a\<in>s. is_predAtom a; distinct (map fst (objects P)); wf_types; fst ` set (objects P) \<inter> fst ` set (consts D) = {}; distinct (map pred (predicates D)); \<forall>x\<in>set (objects P). case x of (n, x) \<Rightarrow> wf_type x; Ball (set (predicates D)) wf_predicate_decl; distinct (init P); distinct (map fst (consts D)); wf_world_model (set (init P)); wf_fmla objT (goal P); \<forall>x\<in>set (consts D). case x of (n, x) \<Rightarrow> wf_type x; distinct (map ast_action_schema.name (actions D)); Ball (set (actions D)) wf_action_schema; resolve_action_schema n = Some schema; fmla \<in> s \<and> fmla \<notin> set x2 \<or> fmla \<in> set x1; action_params_match schema args; \<forall>x\<in>set x1 \<union> set x2. wf_fmla_atom objT x; ground_action.effect (instantiate_action_schema schema args) = Effect x1 x2\<rbrakk> \<Longrightarrow> is_predAtom fmla
[PROOF STEP]
by (metis ground_action.sel(2) ast_domain.wf_effect.simps
            ast_domain.wf_fmla_atom_alt resolve_action_wf
            wf_ground_action.elims(2) wf_instantiate_action_schema)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma sqnf_update [simp]: "\<And>rt dip dsn dsk flg hops sip.
  rt \<noteq> update rt dip (dsn, dsk, flg, hops, sip, {})
  \<Longrightarrow> sqnf (update rt dip (dsn, dsk, flg, hops, sip, {})) dip = dsk"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>rt dip dsn dsk flg hops sip. rt \<noteq> update rt dip (dsn, dsk, flg, hops, sip, {}) \<Longrightarrow> sqnf (update rt dip (dsn, dsk, flg, hops, sip, {})) dip = dsk
[PROOF STEP]
unfolding update_def sqnf_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>rt dip dsn dsk flg hops sip. rt \<noteq> (case rt dip of None \<Rightarrow> rt(dip \<mapsto> (dsn, dsk, flg, hops, sip, {})) | Some s \<Rightarrow> if \<pi>\<^sub>2 s < \<pi>\<^sub>2 (dsn, dsk, flg, hops, sip, {}) then rt(dip \<mapsto> addpre (dsn, dsk, flg, hops, sip, {}) (\<pi>\<^sub>7 s)) else if \<pi>\<^sub>2 s = \<pi>\<^sub>2 (dsn, dsk, flg, hops, sip, {}) \<and> (\<pi>\<^sub>5 (dsn, dsk, flg, hops, sip, {}) < \<pi>\<^sub>5 s \<or> \<pi>\<^sub>4 s = Aodv_Basic.inv) then rt(dip \<mapsto> addpre (dsn, dsk, flg, hops, sip, {}) (\<pi>\<^sub>7 s)) else if \<pi>\<^sub>3 (dsn, dsk, flg, hops, sip, {}) = unk then rt(dip \<mapsto> (\<pi>\<^sub>2 s, snd (addpre (dsn, dsk, flg, hops, sip, {}) (\<pi>\<^sub>7 s)))) else rt(dip \<mapsto> addpre s (\<pi>\<^sub>7 (dsn, dsk, flg, hops, sip, {})))) \<Longrightarrow> (case (case rt dip of None \<Rightarrow> rt(dip \<mapsto> (dsn, dsk, flg, hops, sip, {})) | Some s \<Rightarrow> if \<pi>\<^sub>2 s < \<pi>\<^sub>2 (dsn, dsk, flg, hops, sip, {}) then rt(dip \<mapsto> addpre (dsn, dsk, flg, hops, sip, {}) (\<pi>\<^sub>7 s)) else if \<pi>\<^sub>2 s = \<pi>\<^sub>2 (dsn, dsk, flg, hops, sip, {}) \<and> (\<pi>\<^sub>5 (dsn, dsk, flg, hops, sip, {}) < \<pi>\<^sub>5 s \<or> \<pi>\<^sub>4 s = Aodv_Basic.inv) then rt(dip \<mapsto> addpre (dsn, dsk, flg, hops, sip, {}) (\<pi>\<^sub>7 s)) else if \<pi>\<^sub>3 (dsn, dsk, flg, hops, sip, {}) = unk then rt(dip \<mapsto> (\<pi>\<^sub>2 s, snd (addpre (dsn, dsk, flg, hops, sip, {}) (\<pi>\<^sub>7 s)))) else rt(dip \<mapsto> addpre s (\<pi>\<^sub>7 (dsn, dsk, flg, hops, sip, {})))) dip of None \<Rightarrow> unk | Some r \<Rightarrow> \<pi>\<^sub>3 r) = dsk
[PROOF STEP]
by (clarsimp split: option.splits if_split_asm) auto


[STATEMENT]
lemma "\<exists>NB. \<exists>evs \<in> woolam.
             Says Server B (Crypt (shrK B) \<lbrace>Agent A, Nonce NB\<rbrace>) \<in> set evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>NB. \<exists>evs\<in>woolam. Says Server B (Crypt (shrK B) \<lbrace>Agent A, Nonce NB\<rbrace>) \<in> set evs
[PROOF STEP]
apply (intro exI bexI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. Says Server B (Crypt (shrK B) \<lbrace>Agent A, Nonce ?NB\<rbrace>) \<in> set ?evs1
 2. ?evs1 \<in> woolam
[PROOF STEP]
apply (rule_tac [2] woolam.Nil
                    [THEN woolam.WL1, THEN woolam.WL2, THEN woolam.WL3,
                     THEN woolam.WL4, THEN woolam.WL5], possibility)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma conf_bool: "G,h \<turnstile> v::\<preceq>PrimT Boolean \<Longrightarrow> \<exists> b. v = Bool b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. G,h \<turnstile> v ::\<preceq> PrimT Boolean \<Longrightarrow> \<exists>b. v = Bool b
[PROOF STEP]
apply (simp add: conf_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>T'. typeof (map_option obj_ty \<circ> h) v = Some T' \<and> G \<turnstile> T' \<preceq> PrimT Boolean \<Longrightarrow> \<exists>b. v = Bool b
[PROOF STEP]
apply (erule exE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>T'. typeof (map_option obj_ty \<circ> h) v = Some T' \<and> G \<turnstile> T' \<preceq> PrimT Boolean \<Longrightarrow> \<exists>b. v = Bool b
[PROOF STEP]
apply (case_tac v)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>T'. \<lbrakk>typeof (map_option obj_ty \<circ> h) v = Some T' \<and> G \<turnstile> T' \<preceq> PrimT Boolean; v = Unit\<rbrakk> \<Longrightarrow> \<exists>b. v = Bool b
 2. \<And>T'. \<lbrakk>typeof (map_option obj_ty \<circ> h) v = Some T' \<and> G \<turnstile> T' \<preceq> PrimT Boolean; v = Null\<rbrakk> \<Longrightarrow> \<exists>b. v = Bool b
 3. \<And>T' x3. \<lbrakk>typeof (map_option obj_ty \<circ> h) v = Some T' \<and> G \<turnstile> T' \<preceq> PrimT Boolean; v = Bool x3\<rbrakk> \<Longrightarrow> \<exists>b. v = Bool b
 4. \<And>T' x4. \<lbrakk>typeof (map_option obj_ty \<circ> h) v = Some T' \<and> G \<turnstile> T' \<preceq> PrimT Boolean; v = Intg x4\<rbrakk> \<Longrightarrow> \<exists>b. v = Bool b
 5. \<And>T' x5. \<lbrakk>typeof (map_option obj_ty \<circ> h) v = Some T' \<and> G \<turnstile> T' \<preceq> PrimT Boolean; v = Addr x5\<rbrakk> \<Longrightarrow> \<exists>b. v = Bool b
[PROOF STEP]
apply (auto elim: widen.cases)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done