[STATEMENT]
lemma (in simplification) rb_INV_step[simp]:
  fixes Q :: "('a :: {infinite, linorder}, 'b :: linorder) fmla"
  assumes "rb_INV x Q \<Q>" "Q' \<in> fixbound \<Q> x" "cov x Q' G"
  shows "rb_INV x Q (insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rb_INV x Q (insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))
[PROOF STEP]
proof (rule rb_INV_I, goal_cases finite equiv rrb fv simplified)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. finite (insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))
 2. Exists x Q \<triangleq> DISJ (exists x ` insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))
 3. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> rrb Q'a
 4. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> fv Q'a \<subseteq> fv Q
 5. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
case finite
[PROOF STATE]
proof (state)
this:

goal (5 subgoals):
 1. finite (insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))
 2. Exists x Q \<triangleq> DISJ (exists x ` insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))
 3. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> rrb Q'a
 4. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> fv Q'a \<subseteq> fv Q
 5. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
from assms(1,3)
[PROOF STATE]
proof (chain)
picking this:
rb_INV x Q \<Q>
cov x Q' G
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
rb_INV x Q \<Q>
cov x Q' G

goal (1 subgoal):
 1. finite (insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
finite (insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))

goal (4 subgoals):
 1. Exists x Q \<triangleq> DISJ (exists x ` insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))
 2. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> rrb Q'a
 3. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> fv Q'a \<subseteq> fv Q
 4. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. Exists x Q \<triangleq> DISJ (exists x ` insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))
 2. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> rrb Q'a
 3. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> fv Q'a \<subseteq> fv Q
 4. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
case equiv
[PROOF STATE]
proof (state)
this:

goal (4 subgoals):
 1. Exists x Q \<triangleq> DISJ (exists x ` insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))
 2. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> rrb Q'a
 3. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> fv Q'a \<subseteq> fv Q
 4. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
rb_INV x Q \<Q>
Q' \<in> fixbound \<Q> x
cov x Q' G
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
rb_INV x Q \<Q>
Q' \<in> fixbound \<Q> x
cov x Q' G

goal (1 subgoal):
 1. Exists x Q \<triangleq> DISJ (exists x ` insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))
[PROOF STEP]
unfolding rb_INV_def
[PROOF STATE]
proof (prove)
using this:
finite \<Q> \<and> Exists x Q \<triangleq> DISJ (exists x ` \<Q>) \<and> (\<forall>Q'\<in>\<Q>. rrb Q' \<and> fv Q' \<subseteq> fv Q \<and> simplified Q')
Q' \<in> fixbound \<Q> x
cov x Q' G

goal (1 subgoal):
 1. Exists x Q \<triangleq> DISJ (exists x ` insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))
[PROOF STEP]
by (auto 0 5 simp: fixbound_fv exists_cp_erase exists_cp_subst eqs_noteq exists_Exists
        image_image image_Un insert_commute ac_simps dest: fixbound_in elim!: equiv_trans
        intro:
        equiv_trans[OF DISJ_push_in]
        equiv_trans[OF DISJ_insert_reorder']
        equiv_trans[OF DISJ_insert_reorder]
        intro!:
        equiv_trans[OF DISJ_exists_pull_out]
        equiv_trans[OF equiv_Disj_cong[OF cov_Exists_equiv equiv_refl]]
        equiv_trans[OF equiv_Disj_cong[OF equiv_Disj_cong[OF equiv_Exists_exists_cong[OF equiv_refl] equiv_refl] equiv_refl]]
        simp del: cp.simps)
[PROOF STATE]
proof (state)
this:
Exists x Q \<triangleq> DISJ (exists x ` insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)))

goal (3 subgoals):
 1. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> rrb Q'a
 2. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> fv Q'a \<subseteq> fv Q
 3. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> rrb Q'a
 2. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> fv Q'a \<subseteq> fv Q
 3. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
case (rrb Q)
[PROOF STATE]
proof (state)
this:
Q \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))

goal (3 subgoals):
 1. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> rrb Q'a
 2. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> fv Q'a \<subseteq> fv Q
 3. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
with assms
[PROOF STATE]
proof (chain)
picking this:
rb_INV x Q \<Q>
Q' \<in> fixbound \<Q> x
cov x Q' G
Q \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
rb_INV x Q \<Q>
Q' \<in> fixbound \<Q> x
cov x Q' G
Q \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))

goal (1 subgoal):
 1. rrb Q
[PROOF STEP]
unfolding rb_INV_def
[PROOF STATE]
proof (prove)
using this:
finite \<Q> \<and> Exists x Q \<triangleq> DISJ (exists x ` \<Q>) \<and> (\<forall>Q'\<in>\<Q>. rrb Q' \<and> fv Q' \<subseteq> fv Q \<and> simplified Q')
Q' \<in> fixbound \<Q> x
cov x Q' G
Q \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))

goal (1 subgoal):
 1. rrb Q
[PROOF STEP]
by (auto intro!: rrb_cp_subst rrb_cp[OF rrb_erase] rrb_simp[of "Conj _ _"] dest: fixbound_in simp del: cp.simps)
[PROOF STATE]
proof (state)
this:
rrb Q

goal (2 subgoals):
 1. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> fv Q'a \<subseteq> fv Q
 2. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> fv Q'a \<subseteq> fv Q
 2. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
case (fv Q')
[PROOF STATE]
proof (state)
this:
Q' \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))

goal (2 subgoals):
 1. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> fv Q'a \<subseteq> fv Q
 2. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
with assms
[PROOF STATE]
proof (chain)
picking this:
rb_INV x Q \<Q>
Q' \<in> fixbound \<Q> x
cov x Q' G
Q' \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
rb_INV x Q \<Q>
Q' \<in> fixbound \<Q> x
cov x Q' G
Q' \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))

goal (1 subgoal):
 1. fv Q' \<subseteq> fv Q
[PROOF STEP]
unfolding rb_INV_def
[PROOF STATE]
proof (prove)
using this:
finite \<Q> \<and> Exists x Q \<triangleq> DISJ (exists x ` \<Q>) \<and> (\<forall>Q'\<in>\<Q>. rrb Q' \<and> fv Q' \<subseteq> fv Q \<and> simplified Q')
Q' \<in> fixbound \<Q> x
cov x Q' G
Q' \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))

goal (1 subgoal):
 1. fv Q' \<subseteq> fv Q
[PROOF STEP]
by (auto 0 4 dest!: fv_cp[THEN set_mp] fv_simp[THEN set_mp] fv_DISJ[THEN set_mp, rotated 1] fv_erase[THEN set_mp]
        cov_fv[OF assms(3) _ qps_in, rotated]
        cov_fv[OF assms(3) _ eqs_in, rotated] dest: fixbound_in
        simp: fv_subst fixbound_fv split: if_splits simp del: cp.simps)
[PROOF STATE]
proof (state)
this:
fv Q' \<subseteq> fv Q

goal (1 subgoal):
 1. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
case (simplified Q')
[PROOF STATE]
proof (state)
this:
Q' \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))

goal (1 subgoal):
 1. \<And>Q'a. Q'a \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G)) \<Longrightarrow> simplified Q'a
[PROOF STEP]
with assms
[PROOF STATE]
proof (chain)
picking this:
rb_INV x Q \<Q>
Q' \<in> fixbound \<Q> x
cov x Q' G
Q' \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
rb_INV x Q \<Q>
Q' \<in> fixbound \<Q> x
cov x Q' G
Q' \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))

goal (1 subgoal):
 1. simplified Q'
[PROOF STEP]
unfolding rb_INV_def
[PROOF STATE]
proof (prove)
using this:
finite \<Q> \<and> Exists x Q \<triangleq> DISJ (exists x ` \<Q>) \<and> (\<forall>Q'\<in>\<Q>. rrb Q' \<and> fv Q' \<subseteq> fv Q \<and> simplified Q')
Q' \<in> fixbound \<Q> x
cov x Q' G
Q' \<in> insert (cp (Q' \<^bold>\<bottom> x)) (insert (simp (Conj Q' (DISJ (qps G)))) (\<Q> - {Q'} \<union> (\<lambda>y. cp (Q'[x \<^bold>\<rightarrow> y])) ` eqs x G))

goal (1 subgoal):
 1. simplified Q'
[PROOF STEP]
by (auto simp: simplified_simp simplified_cp simp del: cp.simps)
[PROOF STATE]
proof (state)
this:
simplified Q'

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Stop_is_CSP3: "(relation_of Stop) is CSP3 healthy"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. action.relation_of Stop is CSP3 healthy
[PROOF STEP]
apply (auto simp: relation_of_Stop relation_of_Skip rp_defs design_defs fun_eq_iff CSP3_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b. ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (a, b) \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) ;; ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A'))) (a, b)
 2. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (rule_tac b=a in comp_intro)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b. ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (a, b) \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (a, a)
 2. \<And>a b. ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (a, b) \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (a, b)
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (split cond_splits, auto)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A')) (aa, ba); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (aa, c)
[PROOF STEP]
apply (split cond_splits)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>(wait \<circ> fst) (aa, ba); case (aa, ba) of (A, A') \<Rightarrow> \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A'; (wait \<circ> fst) (ba, c); case (ba, c) of (A, A') \<Rightarrow> \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A'\<rbrakk> \<Longrightarrow> ((wait \<circ> fst) (aa, c) \<longrightarrow> (case (aa, c) of (A, A') \<Rightarrow> \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A')) \<and> (\<not> (wait \<circ> fst) (aa, c) \<longrightarrow> (case (aa, c) of (A, A') \<Rightarrow> (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A'))
 2. \<And>aa ba c. \<lbrakk>(wait \<circ> fst) (aa, ba); case (aa, ba) of (A, A') \<Rightarrow> \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A'; \<not> (wait \<circ> fst) (ba, c); case (ba, c) of (A, A') \<Rightarrow> (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A'\<rbrakk> \<Longrightarrow> ((wait \<circ> fst) (aa, c) \<longrightarrow> (case (aa, c) of (A, A') \<Rightarrow> \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A')) \<and> (\<not> (wait \<circ> fst) (aa, c) \<longrightarrow> (case (aa, c) of (A, A') \<Rightarrow> (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A'))
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> (wait \<circ> fst) (aa, ba); case (aa, ba) of (A, A') \<Rightarrow> (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> \<not> wait A' \<and> alpha_rp.more A = alpha_rp.more A') \<and> tr A \<le> tr A'\<rbrakk> \<Longrightarrow> ((wait \<circ> fst) (aa, c) \<longrightarrow> (case (aa, c) of (A, A') \<Rightarrow> \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A')) \<and> (\<not> (wait \<circ> fst) (aa, c) \<longrightarrow> (case (aa, c) of (A, A') \<Rightarrow> (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A'))
[PROOF STEP]
apply (simp_all)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba \<or> ok ba \<and> tr aa = tr ba \<and> ref aa = ref ba \<and> alpha_rp.more aa = alpha_rp.more ba; wait ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> \<not> ok aa \<and> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (case_tac "ok aa", simp_all)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; tr aa \<le> tr ba \<or> ok ba \<and> tr aa = tr ba \<and> ref aa = ref ba \<and> alpha_rp.more aa = alpha_rp.more ba; wait ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c; \<not> ok aa\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (case_tac "tr aa \<le> tr ba", simp_all)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; wait ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c; \<not> ok aa; tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (case_tac "ok ba", simp_all)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; wait ba; tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c; \<not> ok aa; tr aa \<le> tr ba; \<not> ok ba\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (case_tac "tr ba \<le> tr c", simp_all)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; wait ba; \<not> ok aa; tr aa \<le> tr ba; \<not> ok ba; tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (rule disjI1)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; wait ba; \<not> ok aa; tr aa \<le> tr ba; \<not> ok ba; tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (simp add: prefix_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; wait ba; \<not> ok aa; \<exists>zs. tr ba = tr aa @ zs; \<not> ok ba; \<exists>zs. tr c = tr ba @ zs\<rbrakk> \<Longrightarrow> \<exists>zs. tr c = tr aa @ zs
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (erule exE)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c zs zsa. \<lbrakk>wait aa; wait ba; \<not> ok aa; \<not> ok ba; tr ba = tr aa @ zs; tr c = tr ba @ zsa\<rbrakk> \<Longrightarrow> \<exists>zs. tr c = tr aa @ zs
 2. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 3. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (rule_tac x="zs@zsa" in exI, simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c \<or> ok c \<and> tr aa = tr c \<and> wait c \<and> ref aa = ref c \<and> alpha_rp.more aa = alpha_rp.more c
 2. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (rule disjI1)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> tr aa \<le> tr ba; \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c
 2. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (simp add: prefix_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa ba c. \<lbrakk>wait aa; \<not> ok aa \<and> (\<exists>zs. tr ba = tr aa @ zs); \<not> wait ba; (ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> (\<exists>zs. tr c = tr ba @ zs)\<rbrakk> \<Longrightarrow> \<exists>zs. tr c = tr aa @ zs
 2. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (erule exE | erule conjE)+
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa ba c zs zsa. \<lbrakk>wait aa; \<not> wait ba; \<not> ok aa; tr ba = tr aa @ zs; ok ba \<and> true (ba\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr ba\<rparr>) \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c; tr c = tr ba @ zsa\<rbrakk> \<Longrightarrow> \<exists>zs. tr c = tr aa @ zs
 2. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (rule_tac x="zs@zsa" in exI, simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A')) (ba, c); \<not> wait aa; (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba) \<and> tr aa \<le> tr ba\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (split cond_splits)+
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa ba c. \<lbrakk>\<not> wait aa; (wait \<circ> fst) (ba, c); ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba; tr aa \<le> tr ba; case (ba, c) of (A, A') \<Rightarrow> \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A'\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
 2. \<And>aa ba c. \<lbrakk>\<not> wait aa; \<not> (wait \<circ> fst) (ba, c); ok aa \<and> true (aa\<lparr>tr := []\<rparr>, ba\<lparr>tr := tr ba - tr aa\<rparr>) \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> \<not> wait ba \<and> alpha_rp.more aa = alpha_rp.more ba; tr aa \<le> tr ba; case (ba, c) of (A, A') \<Rightarrow> (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> tr A' - tr A = [] \<and> wait A') \<and> tr A \<le> tr A'\<rbrakk> \<Longrightarrow> (ok aa \<and> true (aa\<lparr>tr := []\<rparr>, c\<lparr>tr := tr c - tr aa\<rparr>) \<longrightarrow> ok c \<and> tr c - tr aa = [] \<and> wait c) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (simp_all add: true_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa ba c. \<lbrakk>\<not> wait aa; wait ba; \<not> ok aa; tr aa \<le> tr ba; \<not> ok ba \<and> tr ba \<le> tr c \<or> ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c
 2. \<And>aa ba c. \<lbrakk>\<not> wait aa; \<not> wait ba; ok aa \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> alpha_rp.more aa = alpha_rp.more ba; tr aa \<le> tr ba; (ok ba \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> (ok aa \<longrightarrow> tr c - tr aa = []) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (erule disjE)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>\<not> wait aa; wait ba; \<not> ok aa; tr aa \<le> tr ba; \<not> ok ba \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c
 2. \<And>aa ba c. \<lbrakk>\<not> wait aa; wait ba; \<not> ok aa; tr aa \<le> tr ba; ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c
 3. \<And>aa ba c. \<lbrakk>\<not> wait aa; \<not> wait ba; ok aa \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> alpha_rp.more aa = alpha_rp.more ba; tr aa \<le> tr ba; (ok ba \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> (ok aa \<longrightarrow> tr c - tr aa = []) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (simp add: prefix_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c. \<lbrakk>\<not> wait aa; wait ba; \<not> ok aa; \<exists>zs. tr ba = tr aa @ zs; \<not> ok ba \<and> (\<exists>zs. tr c = tr ba @ zs)\<rbrakk> \<Longrightarrow> \<exists>zs. tr c = tr aa @ zs
 2. \<And>aa ba c. \<lbrakk>\<not> wait aa; wait ba; \<not> ok aa; tr aa \<le> tr ba; ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c
 3. \<And>aa ba c. \<lbrakk>\<not> wait aa; \<not> wait ba; ok aa \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> alpha_rp.more aa = alpha_rp.more ba; tr aa \<le> tr ba; (ok ba \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> (ok aa \<longrightarrow> tr c - tr aa = []) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (erule exE | erule conjE)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>aa ba c zs zsa. \<lbrakk>\<not> wait aa; wait ba; \<not> ok aa; tr ba = tr aa @ zs; \<not> ok ba; tr c = tr ba @ zsa\<rbrakk> \<Longrightarrow> \<exists>zs. tr c = tr aa @ zs
 2. \<And>aa ba c. \<lbrakk>\<not> wait aa; wait ba; \<not> ok aa; tr aa \<le> tr ba; ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c
 3. \<And>aa ba c. \<lbrakk>\<not> wait aa; \<not> wait ba; ok aa \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> alpha_rp.more aa = alpha_rp.more ba; tr aa \<le> tr ba; (ok ba \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> (ok aa \<longrightarrow> tr c - tr aa = []) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (rule_tac x="zs@zsa" in exI, simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa ba c. \<lbrakk>\<not> wait aa; wait ba; \<not> ok aa; tr aa \<le> tr ba; ok c \<and> tr ba = tr c \<and> wait c \<and> ref ba = ref c \<and> alpha_rp.more ba = alpha_rp.more c\<rbrakk> \<Longrightarrow> tr aa \<le> tr c
 2. \<And>aa ba c. \<lbrakk>\<not> wait aa; \<not> wait ba; ok aa \<longrightarrow> ok ba \<and> tr ba - tr aa = [] \<and> alpha_rp.more aa = alpha_rp.more ba; tr aa \<le> tr ba; (ok ba \<longrightarrow> ok c \<and> tr c - tr ba = [] \<and> wait c) \<and> tr ba \<le> tr c\<rbrakk> \<Longrightarrow> (ok aa \<longrightarrow> tr c - tr aa = []) \<and> tr aa \<le> tr c
[PROOF STEP]
apply (auto simp add: prefix_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma add_edge_wf: "wf_list_graph G \<Longrightarrow> wf_list_graph (add_edge v v' G)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf_list_graph G \<Longrightarrow> wf_list_graph (FiniteListGraph.add_edge v v' G)
[PROOF STEP]
unfolding wf_list_graph_def add_edge_def add_node_def wf_list_graph_axioms_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct (nodesL G) \<and> distinct (edgesL G) \<and> fst ` set (edgesL G) \<subseteq> set (nodesL G) \<and> snd ` set (edgesL G) \<subseteq> set (nodesL G) \<Longrightarrow> distinct (nodesL (\<lparr>nodesL = if v \<in> set (nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>) then nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr> else v # nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>, edgesL = edgesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>\<rparr>\<lparr>edgesL := if (v, v') \<in> set (edgesL G) then edgesL G else (v, v') # edgesL G\<rparr>)) \<and> distinct (edgesL (\<lparr>nodesL = if v \<in> set (nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>) then nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr> else v # nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>, edgesL = edgesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>\<rparr>\<lparr>edgesL := if (v, v') \<in> set (edgesL G) then edgesL G else (v, v') # edgesL G\<rparr>)) \<and> fst ` set (edgesL (\<lparr>nodesL = if v \<in> set (nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>) then nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr> else v # nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>, edgesL = edgesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>\<rparr>\<lparr>edgesL := if (v, v') \<in> set (edgesL G) then edgesL G else (v, v') # edgesL G\<rparr>)) \<subseteq> set (nodesL (\<lparr>nodesL = if v \<in> set (nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>) then nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr> else v # nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>, edgesL = edgesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>\<rparr>\<lparr>edgesL := if (v, v') \<in> set (edgesL G) then edgesL G else (v, v') # edgesL G\<rparr>)) \<and> snd ` set (edgesL (\<lparr>nodesL = if v \<in> set (nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>) then nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr> else v # nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>, edgesL = edgesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>\<rparr>\<lparr>edgesL := if (v, v') \<in> set (edgesL G) then edgesL G else (v, v') # edgesL G\<rparr>)) \<subseteq> set (nodesL (\<lparr>nodesL = if v \<in> set (nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>) then nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr> else v # nodesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>, edgesL = edgesL \<lparr>nodesL = if v' \<in> set (nodesL G) then nodesL G else v' # nodesL G, edgesL = edgesL G\<rparr>\<rparr>\<lparr>edgesL := if (v, v') \<in> set (edgesL G) then edgesL G else (v, v') # edgesL G\<rparr>))
[PROOF STEP]
by auto


[STATEMENT]
lemma refined_prog_secure:
  assumes len\<^sub>A [simp]: "length cms\<^sub>C = length cms"
  assumes len\<^sub>C [simp]: "length cms\<^sub>A = length cms"
  assumes in_\<R>: "(\<And>i mem\<^sub>C. i < length cms \<Longrightarrow>  ((cms\<^sub>A ! i,mem\<^sub>A_of mem\<^sub>C),(cms\<^sub>C ! i, mem\<^sub>C)) \<in> \<R>_rel (cms ! i))"
  assumes in_\<R>\<^sub>A: "(\<And>i mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; conc.low_mds_eq (snd (cms\<^sub>C ! i)) mem\<^sub>C mem\<^sub>C'\<rbrakk>
       \<Longrightarrow> ((cms\<^sub>A ! i, mem\<^sub>A_of mem\<^sub>C), (cms\<^sub>A ! i, mem\<^sub>A_of mem\<^sub>C')) \<in> \<R>\<^sub>A_rel (cms ! i))"
  assumes sound_mode_use\<^sub>A: "(\<And> mem\<^sub>A.  abs.sound_mode_use (cms\<^sub>A, mem\<^sub>A))"
  assumes modes_respect_priv: "modes_respect_priv (map snd cms\<^sub>C)"
  shows "conc.prog_sifum_secure_cont cms\<^sub>C"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. conc.prog_sifum_secure_cont cms\<^sub>C
[PROOF STEP]
apply(rule conc.sifum_compositionality_cont)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. list_all conc.com_sifum_secure cms\<^sub>C
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(clarsimp simp: list_all_length)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>n. n < length cms \<Longrightarrow> conc.com_sifum_secure (cms\<^sub>C ! n)
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(clarsimp simp: conc.com_sifum_secure_def conc.low_indistinguishable_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> conc.mm_equiv_abv \<langle>c, mds\<^sub>s, mem\<^sub>1\<rangle>\<^sub>C \<langle>c, mds\<^sub>s, mem\<^sub>2\<rangle>\<^sub>C
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rule conc.mm_equiv.intros)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> conc.strong_low_bisim_mm (?\<R>13 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2)
 2. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> (\<langle>c, mds\<^sub>s, mem\<^sub>1\<rangle>\<^sub>C, \<langle>c, mds\<^sub>s, mem\<^sub>2\<rangle>\<^sub>C) \<in> ?\<R>13 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2
 3. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rule R\<^sub>C_of_strong_low_bisim_mm)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> abs.strong_low_bisim_mm (?\<R>\<^sub>A16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2)
 2. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> secure_refinement (?\<R>\<^sub>A16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2) (?\<R>16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2) (?P16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2)
 3. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> sym (?P16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2)
 4. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> (\<langle>c, mds\<^sub>s, mem\<^sub>1\<rangle>\<^sub>C, \<langle>c, mds\<^sub>s, mem\<^sub>2\<rangle>\<^sub>C) \<in> R\<^sub>C_of (?\<R>\<^sub>A16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2) (?\<R>16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2) (?P16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2)
 5. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(fastforce intro: bisims)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> secure_refinement (\<R>\<^sub>A_rel (cms ! n)) (?\<R>16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2) (?P16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2)
 2. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> sym (?P16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2)
 3. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> (\<langle>c, mds\<^sub>s, mem\<^sub>1\<rangle>\<^sub>C, \<langle>c, mds\<^sub>s, mem\<^sub>2\<rangle>\<^sub>C) \<in> R\<^sub>C_of (\<R>\<^sub>A_rel (cms ! n)) (?\<R>16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2) (?P16 n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2)
 4. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(fastforce intro: secure_refinements)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> sym (P_rel (cms ! n))
 2. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> (\<langle>c, mds\<^sub>s, mem\<^sub>1\<rangle>\<^sub>C, \<langle>c, mds\<^sub>s, mem\<^sub>2\<rangle>\<^sub>C) \<in> R\<^sub>C_of (\<R>\<^sub>A_rel (cms ! n)) (\<R>_rel (cms ! n)) (P_rel (cms ! n))
 3. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(fastforce simp: Ps_sym)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> (\<langle>c, mds\<^sub>s, mem\<^sub>1\<rangle>\<^sub>C, \<langle>c, mds\<^sub>s, mem\<^sub>2\<rangle>\<^sub>C) \<in> R\<^sub>C_of (\<R>\<^sub>A_rel (cms ! n)) (\<R>_rel (cms ! n)) (P_rel (cms ! n))
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(clarsimp simp: R\<^sub>C_of_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>n c mds\<^sub>s mem\<^sub>1 mem\<^sub>2. \<lbrakk>n < length cms; cms\<^sub>C ! n = (c, mds\<^sub>s); conc.low_mds_eq mds\<^sub>s mem\<^sub>1 mem\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>a b ba. (\<langle>a, b, ba\<rangle>\<^sub>A, \<langle>c, mds\<^sub>s, mem\<^sub>1\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! n) \<and> (\<exists>aa bb bc. (\<langle>aa, bb, bc\<rangle>\<^sub>A, \<langle>c, mds\<^sub>s, mem\<^sub>2\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! n) \<and> (\<langle>a, b, ba\<rangle>\<^sub>A, \<langle>aa, bb, bc\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! n) \<and> (\<langle>c, mds\<^sub>s, mem\<^sub>1\<rangle>\<^sub>C, \<langle>c, mds\<^sub>s, mem\<^sub>2\<rangle>\<^sub>C) \<in> P_rel (cms ! n))
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rename_tac i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C')
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> \<exists>a b ba. (\<langle>a, b, ba\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<exists>aa bb bc. (\<langle>aa, bb, bc\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<langle>a, b, ba\<rangle>\<^sub>A, \<langle>aa, bb, bc\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i))
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rule_tac x="fst (cms\<^sub>A ! i)" in exI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> \<exists>b ba. (\<langle>fst (cms\<^sub>A ! i), b, ba\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<exists>a bb bc. (\<langle>a, bb, bc\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<langle>fst (cms\<^sub>A ! i), b, ba\<rangle>\<^sub>A, \<langle>a, bb, bc\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i))
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rule_tac x="snd (cms\<^sub>A ! i)" in exI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> \<exists>b. (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), b\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<exists>a ba bb. (\<langle>a, ba, bb\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), b\<rangle>\<^sub>A, \<langle>a, ba, bb\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i))
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rule_tac x="mem\<^sub>A_of mem\<^sub>C" in exI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<exists>a b ba. (\<langle>a, b, ba\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>a, b, ba\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i))
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i)
 2. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> \<exists>a b ba. (\<langle>a, b, ba\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>a, b, ba\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i)
 3. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
using in_\<R>
[PROOF STATE]
proof (prove)
using this:
?i7 < length cms \<Longrightarrow> ((cms\<^sub>A ! ?i7, mem\<^sub>A_of ?mem\<^sub>C7), cms\<^sub>C ! ?i7, ?mem\<^sub>C7) \<in> \<R>_rel (cms ! ?i7)

goal (3 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i)
 2. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> \<exists>a b ba. (\<langle>a, b, ba\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>a, b, ba\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i)
 3. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> \<exists>a b ba. (\<langle>a, b, ba\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>a, b, ba\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i)
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rule_tac x="fst (cms\<^sub>A ! i)" in exI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> \<exists>b ba. (\<langle>fst (cms\<^sub>A ! i), b, ba\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>fst (cms\<^sub>A ! i), b, ba\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i)
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rule_tac x="snd (cms\<^sub>A ! i)" in exI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> \<exists>b. (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), b\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), b\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i)
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rule_tac x="mem\<^sub>A_of mem\<^sub>C'" in exI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i) \<and> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C'\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i)
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i)
 2. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C'\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i)
 3. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
using in_\<R>
[PROOF STATE]
proof (prove)
using this:
?i7 < length cms \<Longrightarrow> ((cms\<^sub>A ! ?i7, mem\<^sub>A_of ?mem\<^sub>C7), cms\<^sub>C ! ?i7, ?mem\<^sub>C7) \<in> \<R>_rel (cms ! ?i7)

goal (3 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> \<R>_rel (cms ! i)
 2. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C'\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i)
 3. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'. \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C); conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk> \<Longrightarrow> (\<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A, \<langle>fst (cms\<^sub>A ! i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C'\<rangle>\<^sub>A) \<in> \<R>\<^sub>A_rel (cms ! i) \<and> (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C) \<in> P_rel (cms ! i)
 2. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(fastforce simp: in_\<R>\<^sub>A Ps_refl_on_low_mds_eq)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>mem. True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(clarify)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>mem. True \<Longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)
[PROOF STEP]
apply(rename_tac mem\<^sub>C)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>mem\<^sub>C. True \<Longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem\<^sub>C)
[PROOF STEP]
apply(rule_tac gc\<^sub>A="(cms\<^sub>A,mem\<^sub>A_of mem\<^sub>C)" in sound_mode_use_preservation)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>mem\<^sub>C. True \<Longrightarrow> length (fst (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C)) = length cms
 2. \<And>mem\<^sub>C. True \<Longrightarrow> length (fst (cms\<^sub>C, mem\<^sub>C)) = length cms
 3. \<And>mem\<^sub>C i. \<lbrakk>True; i < length cms\<rbrakk> \<Longrightarrow> ((fst (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C) ! i, snd (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C)), fst (cms\<^sub>C, mem\<^sub>C) ! i, snd (cms\<^sub>C, mem\<^sub>C)) \<in> \<R>_rel (cms ! i)
 4. \<And>mem\<^sub>C. True \<Longrightarrow> abs.sound_mode_use (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C)
 5. \<And>mem\<^sub>C. True \<Longrightarrow> modes_respect_priv (map snd (fst (cms\<^sub>C, mem\<^sub>C)))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>mem\<^sub>C. True \<Longrightarrow> length (fst (cms\<^sub>C, mem\<^sub>C)) = length cms
 2. \<And>mem\<^sub>C i. \<lbrakk>True; i < length cms\<rbrakk> \<Longrightarrow> ((fst (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C) ! i, snd (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C)), fst (cms\<^sub>C, mem\<^sub>C) ! i, snd (cms\<^sub>C, mem\<^sub>C)) \<in> \<R>_rel (cms ! i)
 3. \<And>mem\<^sub>C. True \<Longrightarrow> abs.sound_mode_use (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C)
 4. \<And>mem\<^sub>C. True \<Longrightarrow> modes_respect_priv (map snd (fst (cms\<^sub>C, mem\<^sub>C)))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>mem\<^sub>C i. \<lbrakk>True; i < length cms\<rbrakk> \<Longrightarrow> ((fst (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C) ! i, snd (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C)), fst (cms\<^sub>C, mem\<^sub>C) ! i, snd (cms\<^sub>C, mem\<^sub>C)) \<in> \<R>_rel (cms ! i)
 2. \<And>mem\<^sub>C. True \<Longrightarrow> abs.sound_mode_use (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C)
 3. \<And>mem\<^sub>C. True \<Longrightarrow> modes_respect_priv (map snd (fst (cms\<^sub>C, mem\<^sub>C)))
[PROOF STEP]
using in_\<R>
[PROOF STATE]
proof (prove)
using this:
?i7 < length cms \<Longrightarrow> ((cms\<^sub>A ! ?i7, mem\<^sub>A_of ?mem\<^sub>C7), cms\<^sub>C ! ?i7, ?mem\<^sub>C7) \<in> \<R>_rel (cms ! ?i7)

goal (3 subgoals):
 1. \<And>mem\<^sub>C i. \<lbrakk>True; i < length cms\<rbrakk> \<Longrightarrow> ((fst (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C) ! i, snd (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C)), fst (cms\<^sub>C, mem\<^sub>C) ! i, snd (cms\<^sub>C, mem\<^sub>C)) \<in> \<R>_rel (cms ! i)
 2. \<And>mem\<^sub>C. True \<Longrightarrow> abs.sound_mode_use (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C)
 3. \<And>mem\<^sub>C. True \<Longrightarrow> modes_respect_priv (map snd (fst (cms\<^sub>C, mem\<^sub>C)))
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>mem\<^sub>C. True \<Longrightarrow> abs.sound_mode_use (cms\<^sub>A, mem\<^sub>A_of mem\<^sub>C)
 2. \<And>mem\<^sub>C. True \<Longrightarrow> modes_respect_priv (map snd (fst (cms\<^sub>C, mem\<^sub>C)))
[PROOF STEP]
apply(rule sound_mode_use\<^sub>A)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>mem\<^sub>C. True \<Longrightarrow> modes_respect_priv (map snd (fst (cms\<^sub>C, mem\<^sub>C)))
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. modes_respect_priv (map snd cms\<^sub>C)
[PROOF STEP]
by(rule modes_respect_priv)