[STATEMENT]
lemma Skip_is_CSP4: "(relation_of Skip) is CSP4 healthy"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. action.relation_of Skip is CSP4 healthy
[PROOF STEP]
apply (auto simp: relation_of_Skip rp_defs design_defs fun_eq_iff CSP4_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b. ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (a, b) \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) ;; ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A'))) (a, b)
 2. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (split cond_splits, simp_all)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b. \<lbrakk>wait a; \<not> ok a \<and> tr a \<le> tr b \<or> ok b \<and> tr a = tr b \<and> wait b \<and> ref a = ref b \<and> alpha_rp.more a = alpha_rp.more b\<rbrakk> \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) ;; ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A'))) (a, b)
 2. \<And>a b. \<lbrakk>\<not> wait a; (ok a \<and> true (a\<lparr>tr := []\<rparr>, b\<lparr>tr := tr b - tr a\<rparr>) \<longrightarrow> ok b \<and> tr b - tr a = [] \<and> \<not> wait b \<and> alpha_rp.more a = alpha_rp.more b) \<and> tr a \<le> tr b\<rbrakk> \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) ;; ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A'))) (a, b)
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (rule_tac b=b in comp_intro)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>a b. \<lbrakk>wait a; \<not> ok a \<and> tr a \<le> tr b \<or> ok b \<and> tr a = tr b \<and> wait b \<and> ref a = ref b \<and> alpha_rp.more a = alpha_rp.more b\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (a, b)
 2. \<And>a b. \<lbrakk>wait a; \<not> ok a \<and> tr a \<le> tr b \<or> ok b \<and> tr a = tr b \<and> wait b \<and> ref a = ref b \<and> alpha_rp.more a = alpha_rp.more b\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (b, b)
 3. \<And>a b. \<lbrakk>\<not> wait a; (ok a \<and> true (a\<lparr>tr := []\<rparr>, b\<lparr>tr := tr b - tr a\<rparr>) \<longrightarrow> ok b \<and> tr b - tr a = [] \<and> \<not> wait b \<and> alpha_rp.more a = alpha_rp.more b) \<and> tr a \<le> tr b\<rbrakk> \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) ;; ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A'))) (a, b)
 4. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (split cond_splits, simp_all)+
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b. \<lbrakk>\<not> wait a; (ok a \<and> true (a\<lparr>tr := []\<rparr>, b\<lparr>tr := tr b - tr a\<rparr>) \<longrightarrow> ok b \<and> tr b - tr a = [] \<and> \<not> wait b \<and> alpha_rp.more a = alpha_rp.more b) \<and> tr a \<le> tr b\<rbrakk> \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) ;; ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A'))) (a, b)
 2. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (rule_tac b=b in comp_intro)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b. \<lbrakk>\<not> wait a; (ok a \<and> true (a\<lparr>tr := []\<rparr>, b\<lparr>tr := tr b - tr a\<rparr>) \<longrightarrow> ok b \<and> tr b - tr a = [] \<and> \<not> wait b \<and> alpha_rp.more a = alpha_rp.more b) \<and> tr a \<le> tr b\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (a, b)
 2. \<And>a b. \<lbrakk>\<not> wait a; (ok a \<and> true (a\<lparr>tr := []\<rparr>, b\<lparr>tr := tr b - tr a\<rparr>) \<longrightarrow> ok b \<and> tr b - tr a = [] \<and> \<not> wait b \<and> alpha_rp.more a = alpha_rp.more b) \<and> tr a \<le> tr b\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (b, b)
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (split cond_splits, simp_all)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba \<or> ok ba \<and> tr aa = tr ba \<and> ref aa = ref ba \<and> alpha_rp.more aa = alpha_rp.more ba; wait ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> \<not> ok aa \<and> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> \<not> wait c \<and> alpha_rp.more ba = alpha_rp.more c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> \<not> wait c \<and> alpha_rp.more aa = alpha_rp.more c) \<and> tr aa \<le> tr c
[PROOF STEP]
prefer 3
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> \<not> wait c \<and> alpha_rp.more aa = alpha_rp.more c) \<and> tr aa \<le> tr c
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba \<or> ok ba \<and> tr aa = tr ba \<and> ref aa = ref ba \<and> alpha_rp.more aa = alpha_rp.more ba; wait ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> \<not> ok aa \<and> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> \<not> wait c \<and> alpha_rp.more ba = alpha_rp.more c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
[PROOF STEP]
apply (split cond_splits, simp_all)+
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>aa ba c. \<lbrakk>\<not> wait aa; wait ba; ok aa \<longrightarrow> \<not> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>); tr aa \<le> tr ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> \<not> wait c \<and> alpha_rp.more aa = alpha_rp.more c) \<and> tr aa \<le> tr c
 2. \<And>aa ba c. \<lbrakk>\<not> wait aa; \<not> wait ba; ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> alpha_rp.more aa = alpha_rp.more ba; tr aa \<le> tr ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> \<not> wait c \<and> alpha_rp.more ba = alpha_rp.more c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> \<not> wait c \<and> alpha_rp.more aa = alpha_rp.more c) \<and> tr aa \<le> tr c
 3. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba \<or> ok ba \<and> tr aa = tr ba \<and> ref aa = ref ba \<and> alpha_rp.more aa = alpha_rp.more ba; wait ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> \<not> ok aa \<and> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 4. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> \<not> wait c \<and> alpha_rp.more ba = alpha_rp.more c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
[PROOF STEP]
apply (auto simp add: prefix_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma l_delete_shadow_root_get_tag_name_get_tag_name_locs [instances]: "l_delete_shadow_root_get_tag_name get_tag_name_locs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_delete_shadow_root_get_tag_name get_tag_name_locs
[PROOF STEP]
apply(auto simp add: l_delete_shadow_root_get_tag_name_def)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>h shadow_root_ptr h' r ptr'. \<lbrakk>h \<turnstile> delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M shadow_root_ptr \<rightarrow>\<^sub>h h'; r \<in> get_tag_name_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
using get_tag_name_delete_shadow_root
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?h \<turnstile> delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M ?shadow_root_ptr \<rightarrow>\<^sub>h ?h'; ?r \<in> get_tag_name_locs ?ptr'\<rbrakk> \<Longrightarrow> ?r ?h ?h'

goal (1 subgoal):
 1. \<And>h shadow_root_ptr h' r ptr'. \<lbrakk>h \<turnstile> delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M shadow_root_ptr \<rightarrow>\<^sub>h h'; r \<in> get_tag_name_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
apply fast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma Gar_Coll:
  "\<parallel>- \<lbrace>\<acute>Proper \<and> \<acute>Mut_init \<and> \<acute>z\<rbrace>
  COBEGIN
   Collector
  \<lbrace>False\<rbrace>
 \<parallel>
   Mutator
  \<lbrace>False\<rbrace>
 COEND
  \<lbrace>False\<rbrace>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<parallel>- \<lbrace>\<acute>Proper \<and> \<acute>Mut_init \<and> \<acute>z\<rbrace>
COBEGIN
Collector
\<lbrace>False\<rbrace>
\<parallel>
Mutator
\<lbrace>False\<rbrace>
COEND
\<lbrace>False\<rbrace>
[PROOF STEP]
apply oghoare
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<lbrace>\<acute>Proper\<rbrace> \<inter> (\<lbrace>\<acute>Mut_init\<rbrace> \<inter> \<lbrace>\<acute>z\<rbrace>) \<subseteq> pre (the (OG_Hoare.com (Some Mutator, \<lbrace>False\<rbrace>))) \<inter> (pre (the (OG_Hoare.com (Some Collector, \<lbrace>False\<rbrace>))) \<inter> \<lbrace>\<forall>i. False \<longrightarrow> \<acute>(\<in>) (pre (the (OG_Hoare.com ((Collector
\<lbrace>False\<rbrace>
\<parallel>
Mutator
\<lbrace>False\<rbrace>) ! i))))\<rbrace>)
 2. \<turnstile> Collector
 \<lbrace>False\<rbrace>
 3. \<turnstile> Mutator
 \<lbrace>False\<rbrace>
 4. interfree_aux (Some Collector, \<lbrace>False\<rbrace>, Some Mutator)
 5. interfree_aux (Some Mutator, \<lbrace>False\<rbrace>, Some Collector)
 6. OG_Hoare.post (Some Mutator, \<lbrace>False\<rbrace>) \<inter> (OG_Hoare.post (Some Collector, \<lbrace>False\<rbrace>) \<inter> \<lbrace>\<forall>i. False \<longrightarrow> \<acute>(\<in>) (OG_Hoare.post ((Collector
\<lbrace>False\<rbrace>
\<parallel>
Mutator
\<lbrace>False\<rbrace>) ! i))\<rbrace>) \<subseteq> \<lbrace>False\<rbrace>
[PROOF STEP]
apply(force simp add: Mutator_def Collector_def modules)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<turnstile> Collector
 \<lbrace>False\<rbrace>
 2. \<turnstile> Mutator
 \<lbrace>False\<rbrace>
 3. interfree_aux (Some Collector, \<lbrace>False\<rbrace>, Some Mutator)
 4. interfree_aux (Some Mutator, \<lbrace>False\<rbrace>, Some Collector)
 5. OG_Hoare.post (Some Mutator, \<lbrace>False\<rbrace>) \<inter> (OG_Hoare.post (Some Collector, \<lbrace>False\<rbrace>) \<inter> \<lbrace>\<forall>i. False \<longrightarrow> \<acute>(\<in>) (OG_Hoare.post ((Collector
\<lbrace>False\<rbrace>
\<parallel>
Mutator
\<lbrace>False\<rbrace>) ! i))\<rbrace>) \<subseteq> \<lbrace>False\<rbrace>
[PROOF STEP]
apply(rule Collector)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<turnstile> Mutator
 \<lbrace>False\<rbrace>
 2. interfree_aux (Some Collector, \<lbrace>False\<rbrace>, Some Mutator)
 3. interfree_aux (Some Mutator, \<lbrace>False\<rbrace>, Some Collector)
 4. OG_Hoare.post (Some Mutator, \<lbrace>False\<rbrace>) \<inter> (OG_Hoare.post (Some Collector, \<lbrace>False\<rbrace>) \<inter> \<lbrace>\<forall>i. False \<longrightarrow> \<acute>(\<in>) (OG_Hoare.post ((Collector
\<lbrace>False\<rbrace>
\<parallel>
Mutator
\<lbrace>False\<rbrace>) ! i))\<rbrace>) \<subseteq> \<lbrace>False\<rbrace>
[PROOF STEP]
apply(rule Mutator)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. interfree_aux (Some Collector, \<lbrace>False\<rbrace>, Some Mutator)
 2. interfree_aux (Some Mutator, \<lbrace>False\<rbrace>, Some Collector)
 3. OG_Hoare.post (Some Mutator, \<lbrace>False\<rbrace>) \<inter> (OG_Hoare.post (Some Collector, \<lbrace>False\<rbrace>) \<inter> \<lbrace>\<forall>i. False \<longrightarrow> \<acute>(\<in>) (OG_Hoare.post ((Collector
\<lbrace>False\<rbrace>
\<parallel>
Mutator
\<lbrace>False\<rbrace>) ! i))\<rbrace>) \<subseteq> \<lbrace>False\<rbrace>
[PROOF STEP]
apply(simp add:interfree_Collector_Mutator)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. interfree_aux (Some Mutator, \<lbrace>False\<rbrace>, Some Collector)
 2. OG_Hoare.post (Some Mutator, \<lbrace>False\<rbrace>) \<inter> (OG_Hoare.post (Some Collector, \<lbrace>False\<rbrace>) \<inter> \<lbrace>\<forall>i. False \<longrightarrow> \<acute>(\<in>) (OG_Hoare.post ((Collector
\<lbrace>False\<rbrace>
\<parallel>
Mutator
\<lbrace>False\<rbrace>) ! i))\<rbrace>) \<subseteq> \<lbrace>False\<rbrace>
[PROOF STEP]
apply(simp add:interfree_Mutator_Collector)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OG_Hoare.post (Some Mutator, \<lbrace>False\<rbrace>) \<inter> (OG_Hoare.post (Some Collector, \<lbrace>False\<rbrace>) \<inter> \<lbrace>\<forall>i. False \<longrightarrow> \<acute>(\<in>) (OG_Hoare.post ((Collector
\<lbrace>False\<rbrace>
\<parallel>
Mutator
\<lbrace>False\<rbrace>) ! i))\<rbrace>) \<subseteq> \<lbrace>False\<rbrace>
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_tag_name_type_wf_preserved [simp]:
  "h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> CharacterDataClass.type_wf h = CharacterDataClass.type_wf h'
[PROOF STEP]
apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
      dest!: get_heap_E
      elim!: bind_returns_heap_E2
      intro!: type_wf_put_I ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I
      ObjectMonad.type_wf_put_I)[1]
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ElementClass.type_wf h
 2. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> NodeClass.type_wf h
 3. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 4. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> is_node_kind (cast (cast (x\<lparr>tag_name := v\<rparr>)))
 5. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> CharacterDataClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> NodeClass.type_wf h
 2. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 3. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> is_node_kind (cast (cast (x\<lparr>tag_name := v\<rparr>)))
 4. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> CharacterDataClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 2. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> is_node_kind (cast (cast (x\<lparr>tag_name := v\<rparr>)))
 3. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> CharacterDataClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> is_node_kind (cast (cast (x\<lparr>tag_name := v\<rparr>)))
 2. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> CharacterDataClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; CharacterDataClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> CharacterDataClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs ElementMonad.get_M_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 2. \<And>x node_ptr. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; node_ptr |\<in>| node_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get node_ptr h = Some y
 3. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
using ObjectMonad.type_wf_put_ptr_in_heap_E ObjectMonad.type_wf_put_ptr_not_in_heap_E
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>ObjectClass.type_wf (put ?ptr ?obj ?h); ?ptr |\<in>| object_ptr_kinds ?h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf ?h
\<lbrakk>ObjectClass.type_wf (put ?ptr ?obj ?h); ?ptr |\<notin>| object_ptr_kinds ?h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf ?h

goal (3 subgoals):
 1. \<And>x. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 2. \<And>x node_ptr. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; node_ptr |\<in>| node_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get node_ptr h = Some y
 3. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x node_ptr. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; node_ptr |\<in>| node_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get node_ptr h = Some y
 2. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
apply (metis (no_types, lifting) bind_eq_Some_conv finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; ObjectClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h); \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
apply (metis finite_set_in)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma Skip_is_CSP3: "(relation_of Skip) is CSP3 healthy"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. action.relation_of Skip is CSP3 healthy
[PROOF STEP]
apply (auto simp: relation_of_Skip rp_defs design_defs fun_eq_iff CSP3_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b. ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (a, b) \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) ;; ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A'))) (a, b)
 2. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (split cond_splits, simp_all)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b. \<lbrakk>wait a; \<not> ok a \<and> tr a \<le> tr b \<or> ok b \<and> tr a = tr b \<and> wait b \<and> ref a = ref b \<and> alpha_rp.more a = alpha_rp.more b\<rbrakk> \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) ;; ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A'))) (a, b)
 2. \<And>a b. \<lbrakk>\<not> wait a; (ok a \<and> true (a\<lparr>tr := []\<rparr>, b\<lparr>tr := tr b - tr a\<rparr>) \<longrightarrow> ok b \<and> tr b - tr a = [] \<and> \<not> wait b \<and> alpha_rp.more a = alpha_rp.more b) \<and> tr a \<le> tr b\<rbrakk> \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) ;; ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A'))) (a, b)
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (rule_tac b=b in comp_intro)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>a b. \<lbrakk>wait a; \<not> ok a \<and> tr a \<le> tr b \<or> ok b \<and> tr a = tr b \<and> wait b \<and> ref a = ref b \<and> alpha_rp.more a = alpha_rp.more b\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (a, b)
 2. \<And>a b. \<lbrakk>wait a; \<not> ok a \<and> tr a \<le> tr b \<or> ok b \<and> tr a = tr b \<and> wait b \<and> ref a = ref b \<and> alpha_rp.more a = alpha_rp.more b\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (b, b)
 3. \<And>a b. \<lbrakk>\<not> wait a; (ok a \<and> true (a\<lparr>tr := []\<rparr>, b\<lparr>tr := tr b - tr a\<rparr>) \<longrightarrow> ok b \<and> tr b - tr a = [] \<and> \<not> wait b \<and> alpha_rp.more a = alpha_rp.more b) \<and> tr a \<le> tr b\<rbrakk> \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) ;; ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A'))) (a, b)
 4. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (split cond_splits, simp_all)+
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b. \<lbrakk>\<not> wait a; (ok a \<and> true (a\<lparr>tr := []\<rparr>, b\<lparr>tr := tr b - tr a\<rparr>) \<longrightarrow> ok b \<and> tr b - tr a = [] \<and> \<not> wait b \<and> alpha_rp.more a = alpha_rp.more b) \<and> tr a \<le> tr b\<rbrakk> \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) ;; ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A'))) (a, b)
 2. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (rule_tac b=b in comp_intro)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b. \<lbrakk>\<not> wait a; (ok a \<and> true (a\<lparr>tr := []\<rparr>, b\<lparr>tr := tr b - tr a\<rparr>) \<longrightarrow> ok b \<and> tr b - tr a = [] \<and> \<not> wait b \<and> alpha_rp.more a = alpha_rp.more b) \<and> tr a \<le> tr b\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (a, b)
 2. \<And>a b. \<lbrakk>\<not> wait a; (ok a \<and> true (a\<lparr>tr := []\<rparr>, b\<lparr>tr := tr b - tr a\<rparr>) \<longrightarrow> ok b \<and> tr b - tr a = [] \<and> \<not> wait b \<and> alpha_rp.more a = alpha_rp.more b) \<and> tr a \<le> tr b\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (b, b)
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (split cond_splits, simp_all)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba \<or> ok ba \<and> tr aa = tr ba \<and> ref aa = ref ba \<and> alpha_rp.more aa = alpha_rp.more ba; wait ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> \<not> ok aa \<and> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> \<not> wait c \<and> alpha_rp.more ba = alpha_rp.more c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> \<not> wait c \<and> alpha_rp.more aa = alpha_rp.more c) \<and> tr aa \<le> tr c
[PROOF STEP]
prefer 3
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> \<not> wait c \<and> alpha_rp.more aa = alpha_rp.more c) \<and> tr aa \<le> tr c
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba \<or> ok ba \<and> tr aa = tr ba \<and> ref aa = ref ba \<and> alpha_rp.more aa = alpha_rp.more ba; wait ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> \<not> ok aa \<and> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> \<not> wait c \<and> alpha_rp.more ba = alpha_rp.more c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
[PROOF STEP]
apply (split cond_splits, simp_all)+
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>aa ba c. \<lbrakk>\<not> wait aa; wait ba; ok aa \<longrightarrow> \<not> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>); tr aa \<le> tr ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> \<not> wait c \<and> alpha_rp.more aa = alpha_rp.more c) \<and> tr aa \<le> tr c
 2. \<And>aa ba c. \<lbrakk>\<not> wait aa; \<not> wait ba; ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> alpha_rp.more aa = alpha_rp.more ba; tr aa \<le> tr ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> \<not> wait c \<and> alpha_rp.more ba = alpha_rp.more c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> \<not> wait c \<and> alpha_rp.more aa = alpha_rp.more c) \<and> tr aa \<le> tr c
 3. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba \<or> ok ba \<and> tr aa = tr ba \<and> ref aa = ref ba \<and> alpha_rp.more aa = alpha_rp.more ba; wait ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> \<not> ok aa \<and> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 4. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> \<not> wait c \<and> alpha_rp.more ba = alpha_rp.more c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
[PROOF STEP]
apply (auto simp add: prefix_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done