[STATEMENT]
lemma JVMd_\<E>_heap_read_typedI:
  "\<lbrakk> E \<in> JVM_heap_base.JVMd_\<E> addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\<lambda>_ :: 'heap. typeof_addr) heap_read heap_write P C M vs status;
     \<And>ad al v T. \<lbrakk> NormalAction (ReadMem ad al v) \<in> snd ` lset E; heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T \<rbrakk> \<Longrightarrow> heap_base'.conf TYPE('heap) typeof_addr P v T \<rbrakk>
  \<Longrightarrow> E \<in> JVM_heap_base.JVMd_\<E> addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\<lambda>_ :: 'heap. typeof_addr) (heap_base.heap_read_typed (\<lambda>_ :: 'heap. typeof_addr) heap_read P) heap_write P C M vs status"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>E \<in> lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) ` multithreaded_base.\<E> (final_thread.init_fin_final JVM_final) (multithreaded_base.init_fin JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) heap_read heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls')))) (map NormalAction \<circ> convert_RA) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs)); \<And>ad al v T. \<lbrakk>NormalAction (ReadMem ad al v) \<in> snd ` lset E; heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T\<rbrakk> \<Longrightarrow> heap_base'.conf TYPE('heap) typeof_addr P v T\<rbrakk> \<Longrightarrow> E \<in> lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) ` multithreaded_base.\<E> (final_thread.init_fin_final JVM_final) (multithreaded_base.init_fin JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) (heap_base.heap_read_typed (\<lambda>_. typeof_addr) heap_read P) heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls')))) (map NormalAction \<circ> convert_RA) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs))
[PROOF STEP]
apply(erule imageE, hypsubst)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>\<And>ad al v T. \<lbrakk>NormalAction (ReadMem ad al v) \<in> snd ` lset (lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) x); heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T\<rbrakk> \<Longrightarrow> heap_base'.conf TYPE('heap) typeof_addr P v T; x \<in> multithreaded_base.\<E> (final_thread.init_fin_final JVM_final) (multithreaded_base.init_fin JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) heap_read heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls')))) (map NormalAction \<circ> convert_RA) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs)); E = lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) x\<rbrakk> \<Longrightarrow> lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) x \<in> lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) ` multithreaded_base.\<E> (final_thread.init_fin_final JVM_final) (multithreaded_base.init_fin JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) (heap_base.heap_read_typed (\<lambda>_. typeof_addr) heap_read P) heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls')))) (map NormalAction \<circ> convert_RA) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs))
[PROOF STEP]
apply(rule imageI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>\<And>ad al v T. \<lbrakk>NormalAction (ReadMem ad al v) \<in> snd ` lset (lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) x); heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T\<rbrakk> \<Longrightarrow> heap_base'.conf TYPE('heap) typeof_addr P v T; x \<in> multithreaded_base.\<E> (final_thread.init_fin_final JVM_final) (multithreaded_base.init_fin JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) heap_read heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls')))) (map NormalAction \<circ> convert_RA) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs)); E = lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) x\<rbrakk> \<Longrightarrow> x \<in> multithreaded_base.\<E> (final_thread.init_fin_final JVM_final) (multithreaded_base.init_fin JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) (heap_base.heap_read_typed (\<lambda>_. typeof_addr) heap_read P) heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls')))) (map NormalAction \<circ> convert_RA) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs))
[PROOF STEP]
apply(erule multithreaded_base.\<E>.cases, hypsubst)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x E'. \<lbrakk>\<And>ad al v T. \<lbrakk>NormalAction (ReadMem ad al v) \<in> snd ` lset (lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) (lconcat (lmap (\<lambda>(t, ta). llist_of (map (Pair t) \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>)) E'))); heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T\<rbrakk> \<Longrightarrow> heap_base'.conf TYPE('heap) typeof_addr P v T; E = lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) (lconcat (lmap (\<lambda>(t, ta). llist_of (map (Pair t) \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>)) E')); trsys.Runs (multithreaded_base.redT (final_thread.init_fin_final JVM_final) (multithreaded_base.init_fin JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) heap_read heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls')))) (map NormalAction \<circ> convert_RA)) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs)) E'\<rbrakk> \<Longrightarrow> lconcat (lmap (\<lambda>(t, ta). llist_of (map (Pair t) \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>)) E') \<in> multithreaded_base.\<E> (final_thread.init_fin_final JVM_final) (multithreaded_base.init_fin JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) (heap_base.heap_read_typed (\<lambda>_. typeof_addr) heap_read P) heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls')))) (map NormalAction \<circ> convert_RA) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs))
[PROOF STEP]
apply(rule multithreaded_base.\<E>.intros)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x E'. \<lbrakk>\<And>ad al v T. \<lbrakk>NormalAction (ReadMem ad al v) \<in> snd ` lset (lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) (lconcat (lmap (\<lambda>(t, ta). llist_of (map (Pair t) \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>)) E'))); heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T\<rbrakk> \<Longrightarrow> heap_base'.conf TYPE('heap) typeof_addr P v T; E = lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) (lconcat (lmap (\<lambda>(t, ta). llist_of (map (Pair t) \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>)) E')); trsys.Runs (multithreaded_base.redT (final_thread.init_fin_final JVM_final) (multithreaded_base.init_fin JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) heap_read heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls')))) (map NormalAction \<circ> convert_RA)) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs)) E'\<rbrakk> \<Longrightarrow> trsys.Runs (multithreaded_base.redT (final_thread.init_fin_final JVM_final) (multithreaded_base.init_fin JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) (heap_base.heap_read_typed (\<lambda>_. typeof_addr) heap_read P) heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls')))) (map NormalAction \<circ> convert_RA)) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs)) E'
[PROOF STEP]
apply(subst if_mexecd_heap_read_typed[abs_def])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x E'. \<lbrakk>\<And>ad al v T. \<lbrakk>NormalAction (ReadMem ad al v) \<in> snd ` lset (lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) (lconcat (lmap (\<lambda>(t, ta). llist_of (map (Pair t) \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>)) E'))); heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T\<rbrakk> \<Longrightarrow> heap_base'.conf TYPE('heap) typeof_addr P v T; E = lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) (lconcat (lmap (\<lambda>(t, ta). llist_of (map (Pair t) \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>)) E')); trsys.Runs (multithreaded_base.redT (final_thread.init_fin_final JVM_final) (multithreaded_base.init_fin JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) heap_read heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls')))) (map NormalAction \<circ> convert_RA)) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs)) E'\<rbrakk> \<Longrightarrow> trsys.Runs (multithreaded_base.redT (final_thread.init_fin_final JVM_final) (if_heap_read_typed JVM_final (\<lambda>t ((xcp, frstls), h) ta ((xcp', frstls'), h'). JVM_heap_base.exec_1_d (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) heap_read heap_write P t (Normal (xcp, h, frstls)) ta (Normal (xcp', h', frstls'))) typeof_addr P) (map NormalAction \<circ> convert_RA)) (init_fin_lift_state status (heap_base.start_state (\<lambda>x. x) empty_heap allocate JVM_local_start P C M vs)) E'
[PROOF STEP]
apply(erule if_mthr_Runs_heap_read_typedI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x E' ad al v T. \<lbrakk>\<And>ad al v T. \<lbrakk>NormalAction (ReadMem ad al v) \<in> snd ` lset (lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) (lconcat (lmap (\<lambda>(t, ta). llist_of (map (Pair t) \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>)) E'))); heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T\<rbrakk> \<Longrightarrow> heap_base'.conf TYPE('heap) typeof_addr P v T; E = lappend (llist_of (lift_start_obs (heap_base.start_tid (\<lambda>x. x) empty_heap allocate) (heap_base.start_heap_obs empty_heap allocate))) (lconcat (lmap (\<lambda>(t, ta). llist_of (map (Pair t) \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>)) E')); NormalAction (ReadMem ad al v) \<in> lset (lconcat (lmap (llist_of \<circ> obs_a \<circ> snd) E')); heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T\<rbrakk> \<Longrightarrow> heap_base'.conf TYPE('heap) typeof_addr P v T
[PROOF STEP]
apply(auto simp add: image_Un lset_lmap[symmetric] lmap_lconcat llist.map_comp o_def split_def simp del: lset_lmap)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "DNI \<eta> \<Longrightarrow> nNor \<eta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. DNI \<eta> \<Longrightarrow> nNor \<eta>
[PROOF STEP]
nitpick
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. DNI \<eta> \<Longrightarrow> nNor \<eta>
[PROOF STEP]
oops


[STATEMENT]
lemma (in mut_m) marked_deletions_eq_imp:
  "eq_imp (\<lambda>r'. sys_fM \<^bold>\<otimes> (\<lambda>s. map_option obj_fields (sys_heap s r')) \<^bold>\<otimes> (\<lambda>s. map_option obj_mark (sys_heap s r')) \<^bold>\<otimes> tso_pending_mw_mutate (mutator m))
          marked_deletions"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eq_imp (\<lambda>r' s. (sys_fM s, map_option obj_fields (sys_heap s r'), map_option obj_mark (sys_heap s r'), filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s))) marked_deletions
[PROOF STEP]
unfolding eq_imp_def marked_deletions_def obj_at_field_on_heap_def ran_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>s s'. (\<forall>x. (sys_fM s, map_option obj_fields (sys_heap s x), map_option obj_mark (sys_heap s x), filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s)) = (sys_fM s', map_option obj_fields (sys_heap s' x), map_option obj_mark (sys_heap s' x), filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s'))) \<longrightarrow> (\<forall>x. x \<in> set (sys_mem_store_buffers (mutator m) s) \<longrightarrow> (case x of mw_Mutate r f opt_r' \<Rightarrow> case map_option obj_fields (sys_heap s r) of None \<Rightarrow> False | Some fs \<Rightarrow> case fs f of None \<Rightarrow> True | Some r' \<Rightarrow> marked r' s | _ \<Rightarrow> True)) = (\<forall>x. x \<in> set (sys_mem_store_buffers (mutator m) s') \<longrightarrow> (case x of mw_Mutate r f opt_r' \<Rightarrow> case map_option obj_fields (sys_heap s' r) of None \<Rightarrow> False | Some fs \<Rightarrow> case fs f of None \<Rightarrow> True | Some r' \<Rightarrow> marked r' s' | _ \<Rightarrow> True))
[PROOF STEP]
apply (clarsimp simp: all_conj_distrib)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>sys_fM s = sys_fM s'; \<forall>x. map_option obj_fields (sys_heap s x) = map_option obj_fields (sys_heap s' x); \<forall>x. map_option obj_mark (sys_heap s x) = map_option obj_mark (sys_heap s' x); filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s) = filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s')\<rbrakk> \<Longrightarrow> (\<forall>x. x \<in> set (sys_mem_store_buffers (mutator m) s) \<longrightarrow> (case x of mw_Mutate r f opt_r' \<Rightarrow> case sys_heap s' r of None \<Rightarrow> False | Some x \<Rightarrow> ((\<lambda>fs. case fs f of None \<Rightarrow> True | Some r' \<Rightarrow> marked r' s) \<circ> obj_fields) x | _ \<Rightarrow> True)) = (\<forall>x. x \<in> set (sys_mem_store_buffers (mutator m) s') \<longrightarrow> (case x of mw_Mutate r f opt_r' \<Rightarrow> case sys_heap s' r of None \<Rightarrow> False | Some x \<Rightarrow> ((\<lambda>fs. case fs f of None \<Rightarrow> True | Some r' \<Rightarrow> marked r' s') \<circ> obj_fields) x | _ \<Rightarrow> True))
[PROOF STEP]
apply (drule arg_cong[where f=set])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>sys_fM s = sys_fM s'; \<forall>x. map_option obj_fields (sys_heap s x) = map_option obj_fields (sys_heap s' x); \<forall>x. map_option obj_mark (sys_heap s x) = map_option obj_mark (sys_heap s' x); set (filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s)) = set (filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s'))\<rbrakk> \<Longrightarrow> (\<forall>x. x \<in> set (sys_mem_store_buffers (mutator m) s) \<longrightarrow> (case x of mw_Mutate r f opt_r' \<Rightarrow> case sys_heap s' r of None \<Rightarrow> False | Some x \<Rightarrow> ((\<lambda>fs. case fs f of None \<Rightarrow> True | Some r' \<Rightarrow> marked r' s) \<circ> obj_fields) x | _ \<Rightarrow> True)) = (\<forall>x. x \<in> set (sys_mem_store_buffers (mutator m) s') \<longrightarrow> (case x of mw_Mutate r f opt_r' \<Rightarrow> case sys_heap s' r of None \<Rightarrow> False | Some x \<Rightarrow> ((\<lambda>fs. case fs f of None \<Rightarrow> True | Some r' \<Rightarrow> marked r' s') \<circ> obj_fields) x | _ \<Rightarrow> True))
[PROOF STEP]
apply (subgoal_tac "\<forall>x. marked x s \<longleftrightarrow> marked x s'")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>sys_fM s = sys_fM s'; \<forall>x. map_option obj_fields (sys_heap s x) = map_option obj_fields (sys_heap s' x); \<forall>x. map_option obj_mark (sys_heap s x) = map_option obj_mark (sys_heap s' x); set (filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s)) = set (filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s')); \<forall>x. marked x s = marked x s'\<rbrakk> \<Longrightarrow> (\<forall>x. x \<in> set (sys_mem_store_buffers (mutator m) s) \<longrightarrow> (case x of mw_Mutate r f opt_r' \<Rightarrow> case sys_heap s' r of None \<Rightarrow> False | Some x \<Rightarrow> ((\<lambda>fs. case fs f of None \<Rightarrow> True | Some r' \<Rightarrow> marked r' s) \<circ> obj_fields) x | _ \<Rightarrow> True)) = (\<forall>x. x \<in> set (sys_mem_store_buffers (mutator m) s') \<longrightarrow> (case x of mw_Mutate r f opt_r' \<Rightarrow> case sys_heap s' r of None \<Rightarrow> False | Some x \<Rightarrow> ((\<lambda>fs. case fs f of None \<Rightarrow> True | Some r' \<Rightarrow> marked r' s') \<circ> obj_fields) x | _ \<Rightarrow> True))
 2. \<And>s s'. \<lbrakk>sys_fM s = sys_fM s'; \<forall>x. map_option obj_fields (sys_heap s x) = map_option obj_fields (sys_heap s' x); \<forall>x. map_option obj_mark (sys_heap s x) = map_option obj_mark (sys_heap s' x); set (filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s)) = set (filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s'))\<rbrakk> \<Longrightarrow> \<forall>x. marked x s = marked x s'
[PROOF STEP]
apply (clarsimp cong: option.case_cong)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>sys_fM s = sys_fM s'; \<forall>x. map_option obj_fields (sys_heap s x) = map_option obj_fields (sys_heap s' x); \<forall>x. map_option obj_mark (sys_heap s x) = map_option obj_mark (sys_heap s' x); {x \<in> set (sys_mem_store_buffers (mutator m) s). is_mw_Mutate x} = {x \<in> set (sys_mem_store_buffers (mutator m) s'). is_mw_Mutate x}; \<forall>x. obj_at (\<lambda>obj. obj_mark obj = sys_fM s') x s = marked x s'\<rbrakk> \<Longrightarrow> (\<forall>x. x \<in> set (sys_mem_store_buffers (mutator m) s) \<longrightarrow> (case x of mw_Mutate r f opt_r' \<Rightarrow> case sys_heap s' r of None \<Rightarrow> False | Some x2 \<Rightarrow> case obj_fields x2 f of None \<Rightarrow> True | Some r' \<Rightarrow> marked r' s' | _ \<Rightarrow> True)) = (\<forall>x. x \<in> set (sys_mem_store_buffers (mutator m) s') \<longrightarrow> (case x of mw_Mutate r f opt_r' \<Rightarrow> case sys_heap s' r of None \<Rightarrow> False | Some x2 \<Rightarrow> case obj_fields x2 f of None \<Rightarrow> True | Some r' \<Rightarrow> marked r' s' | _ \<Rightarrow> True))
 2. \<And>s s'. \<lbrakk>sys_fM s = sys_fM s'; \<forall>x. map_option obj_fields (sys_heap s x) = map_option obj_fields (sys_heap s' x); \<forall>x. map_option obj_mark (sys_heap s x) = map_option obj_mark (sys_heap s' x); set (filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s)) = set (filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s'))\<rbrakk> \<Longrightarrow> \<forall>x. marked x s = marked x s'
[PROOF STEP]
apply (rule iffI; clarsimp simp: set_eq_iff split: option.splits mem_store_action.splits; blast)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>sys_fM s = sys_fM s'; \<forall>x. map_option obj_fields (sys_heap s x) = map_option obj_fields (sys_heap s' x); \<forall>x. map_option obj_mark (sys_heap s x) = map_option obj_mark (sys_heap s' x); set (filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s)) = set (filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s'))\<rbrakk> \<Longrightarrow> \<forall>x. marked x s = marked x s'
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s s' x. \<lbrakk>sys_fM s = sys_fM s'; \<forall>x. map_option obj_fields (sys_heap s x) = map_option obj_fields (sys_heap s' x); \<forall>x. map_option obj_mark (sys_heap s x) = map_option obj_mark (sys_heap s' x); {x \<in> set (sys_mem_store_buffers (mutator m) s). is_mw_Mutate x} = {x \<in> set (sys_mem_store_buffers (mutator m) s'). is_mw_Mutate x}\<rbrakk> \<Longrightarrow> obj_at (\<lambda>obj. obj_mark obj = sys_fM s') x s = marked x s'
[PROOF STEP]
apply (rename_tac s s' x)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s s' x. \<lbrakk>sys_fM s = sys_fM s'; \<forall>x. map_option obj_fields (sys_heap s x) = map_option obj_fields (sys_heap s' x); \<forall>x. map_option obj_mark (sys_heap s x) = map_option obj_mark (sys_heap s' x); {x \<in> set (sys_mem_store_buffers (mutator m) s). is_mw_Mutate x} = {x \<in> set (sys_mem_store_buffers (mutator m) s'). is_mw_Mutate x}\<rbrakk> \<Longrightarrow> obj_at (\<lambda>obj. obj_mark obj = sys_fM s') x s = marked x s'
[PROOF STEP]
apply (drule_tac x=x in spec)+
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s s' x. \<lbrakk>sys_fM s = sys_fM s'; {x \<in> set (sys_mem_store_buffers (mutator m) s). is_mw_Mutate x} = {x \<in> set (sys_mem_store_buffers (mutator m) s'). is_mw_Mutate x}; map_option obj_fields (sys_heap s x) = map_option obj_fields (sys_heap s' x); map_option obj_mark (sys_heap s x) = map_option obj_mark (sys_heap s' x)\<rbrakk> \<Longrightarrow> obj_at (\<lambda>obj. obj_mark obj = sys_fM s') x s = marked x s'
[PROOF STEP]
apply (force split: obj_at_splits)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma eval_of_class:
  "\<lbrakk> G \<turnstile> s -e\<succ>a'-> s'; E \<turnstile> e :: Class C; wf_java_prog G; s::\<preceq>E; gx s'=None; a' \<noteq> Null; G=prg E\<rbrakk>
  \<Longrightarrow> (\<exists> lc. a' = Addr lc)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>G \<turnstile> s -e\<succ>a'-> s'; E \<turnstile> e :: Class C; wf_java_prog G; s ::\<preceq> E; gx s' = None; a' \<noteq> Null; G = fst E\<rbrakk> \<Longrightarrow> \<exists>lc. a' = Addr lc
[PROOF STEP]
apply (case_tac s, case_tac s', simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b c aa ba ca. \<lbrakk>fst E \<turnstile> (a, b, c) -e\<succ>a'-> Norm (ba, ca); E \<turnstile> e :: Class C; wf_java_prog (fst E); (a, b, c) ::\<preceq> E; aa = None; a' \<noteq> Null; G = fst E; s = (a, b, c); s' = Norm (ba, ca)\<rbrakk> \<Longrightarrow> \<exists>lc. a' = Addr lc
[PROOF STEP]
apply (frule eval_type_sound, (simp add: gs_def)+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b c aa ba ca. \<lbrakk>fst E \<turnstile> (a, b, c) -e\<succ>a'-> Norm (ba, ca); E \<turnstile> e :: Class C; wf_java_prog (fst E); (a, b, c) ::\<preceq> E; aa = None; a' \<noteq> Null; G = fst E; s = (a, b, c); s' = Norm (ba, ca); Norm (ba, ca) ::\<preceq> E \<and> fst E,ba \<turnstile> a' ::\<preceq> Class C \<and> b \<le>| ba\<rbrakk> \<Longrightarrow> \<exists>lc. a' = Addr lc
[PROOF STEP]
apply (case_tac a')
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b c aa ba ca. \<lbrakk>fst E \<turnstile> (a, b, c) -e\<succ>a'-> Norm (ba, ca); E \<turnstile> e :: Class C; wf_java_prog (fst E); (a, b, c) ::\<preceq> E; aa = None; a' \<noteq> Null; G = fst E; s = (a, b, c); s' = Norm (ba, ca); Norm (ba, ca) ::\<preceq> E \<and> fst E,ba \<turnstile> a' ::\<preceq> Class C \<and> b \<le>| ba; a' = Unit\<rbrakk> \<Longrightarrow> \<exists>lc. a' = Addr lc
 2. \<And>a b c aa ba ca. \<lbrakk>fst E \<turnstile> (a, b, c) -e\<succ>a'-> Norm (ba, ca); E \<turnstile> e :: Class C; wf_java_prog (fst E); (a, b, c) ::\<preceq> E; aa = None; a' \<noteq> Null; G = fst E; s = (a, b, c); s' = Norm (ba, ca); Norm (ba, ca) ::\<preceq> E \<and> fst E,ba \<turnstile> a' ::\<preceq> Class C \<and> b \<le>| ba; a' = Null\<rbrakk> \<Longrightarrow> \<exists>lc. a' = Addr lc
 3. \<And>a b c aa ba ca x3. \<lbrakk>fst E \<turnstile> (a, b, c) -e\<succ>a'-> Norm (ba, ca); E \<turnstile> e :: Class C; wf_java_prog (fst E); (a, b, c) ::\<preceq> E; aa = None; a' \<noteq> Null; G = fst E; s = (a, b, c); s' = Norm (ba, ca); Norm (ba, ca) ::\<preceq> E \<and> fst E,ba \<turnstile> a' ::\<preceq> Class C \<and> b \<le>| ba; a' = Bool x3\<rbrakk> \<Longrightarrow> \<exists>lc. a' = Addr lc
 4. \<And>a b c aa ba ca x4. \<lbrakk>fst E \<turnstile> (a, b, c) -e\<succ>a'-> Norm (ba, ca); E \<turnstile> e :: Class C; wf_java_prog (fst E); (a, b, c) ::\<preceq> E; aa = None; a' \<noteq> Null; G = fst E; s = (a, b, c); s' = Norm (ba, ca); Norm (ba, ca) ::\<preceq> E \<and> fst E,ba \<turnstile> a' ::\<preceq> Class C \<and> b \<le>| ba; a' = Intg x4\<rbrakk> \<Longrightarrow> \<exists>lc. a' = Addr lc
 5. \<And>a b c aa ba ca x5. \<lbrakk>fst E \<turnstile> (a, b, c) -e\<succ>a'-> Norm (ba, ca); E \<turnstile> e :: Class C; wf_java_prog (fst E); (a, b, c) ::\<preceq> E; aa = None; a' \<noteq> Null; G = fst E; s = (a, b, c); s' = Norm (ba, ca); Norm (ba, ca) ::\<preceq> E \<and> fst E,ba \<turnstile> a' ::\<preceq> Class C \<and> b \<le>| ba; a' = Addr x5\<rbrakk> \<Longrightarrow> \<exists>lc. a' = Addr lc
[PROOF STEP]
apply (auto simp: conf_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma cnf_of_encode_problem_structure:
  shows "cnf (SAT_Plan_Base.encode_initial_state \<Pi>)
    \<subseteq> cnf (SAT_Plan_Base.encode_problem \<Pi> t)"
    and "cnf (SAT_Plan_Base.encode_goal_state \<Pi> t)
      \<subseteq> cnf (SAT_Plan_Base.encode_problem \<Pi> t)"
    and "cnf (SAT_Plan_Base.encode_operators \<Pi> t)
      \<subseteq> cnf (SAT_Plan_Base.encode_problem \<Pi> t)"
    and "cnf (SAT_Plan_Base.encode_all_frame_axioms \<Pi> t)
      \<subseteq> cnf (SAT_Plan_Base.encode_problem \<Pi> t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (cnf (\<Phi>\<^sub>I \<Pi>) \<subseteq> cnf (\<Phi> \<Pi> t) &&& cnf ((\<Phi>\<^sub>G \<Pi>) t) \<subseteq> cnf (\<Phi> \<Pi> t)) &&& cnf (encode_operators \<Pi> t) \<subseteq> cnf (\<Phi> \<Pi> t) &&& cnf (encode_all_frame_axioms \<Pi> t) \<subseteq> cnf (\<Phi> \<Pi> t)
[PROOF STEP]
unfolding SAT_Plan_Base.encode_problem_def
    SAT_Plan_Base.encode_problem_def[of \<Pi> t] SAT_Plan_Base.encode_initial_state_def[of \<Pi>]
    SAT_Plan_Base.encode_goal_state_def[of \<Pi> t] SAT_Plan_Base.encode_operators_def
    SAT_Plan_Base.encode_all_frame_axioms_def[of \<Pi> t]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (cnf (let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs))))) &&& cnf (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))) &&& cnf (let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs))))) &&& cnf (let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cnf (let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. cnf (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))
 2. cnf (let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))
 3. cnf (let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cnf (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))
[PROOF STEP]
by force
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. cnf (let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))
 2. cnf (let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cnf (let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cnf (let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cnf (let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<subseteq> cnf ((let I = \<Pi>\<^sub>I; vs = \<Pi>\<^sub>\<V> in \<^bold>\<And>map (\<lambda>v. encode_state_variable 0 (index vs v) (I v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. I v \<noteq> None) vs)) \<^bold>\<and> ((let ops = \<Pi>\<^sub>\<O> in encode_all_operator_preconditions \<Pi> ops t \<^bold>\<and> encode_all_operator_effects \<Pi> ops t) \<^bold>\<and> ((let l = List.product [0..<t] (\<Pi>\<^sub>\<V>) in \<^bold>\<And>map (\<lambda>(k, v). encode_negative_transition_frame_axiom \<Pi> k v) l @ map (\<lambda>(k, v). encode_positive_transition_frame_axiom \<Pi> k v) l) \<^bold>\<and> (let vs = \<Pi>\<^sub>\<V>; G = \<Pi>\<^sub>G in \<^bold>\<And>map (\<lambda>v. encode_state_variable t (index vs v) (G v) \<^bold>\<or> \<bottom>) (filter (\<lambda>v. G v \<noteq> None) vs)))))
[PROOF STEP]
by force
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done

\<comment> \<open> A technical lemma which shows a simpler form of the CNF of the initial state encoding. \<close>


[STATEMENT]
lemma HeronConf_interp_stepwise_kills_cases:
   \<open>\<lbrakk> \<Gamma>, n \<turnstile> ((K\<^sub>1 kills K\<^sub>2) # \<Psi>) \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
    = \<lbrakk> ((K\<^sub>1 \<not>\<Up> n) # \<Gamma>), n \<turnstile> \<Psi> \<triangleright> ((K\<^sub>1 kills K\<^sub>2) # \<Phi>) \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
    \<union> \<lbrakk> ((K\<^sub>1 \<Up> n) # (K\<^sub>2 \<not>\<Up> \<ge> n) # \<Gamma>), n \<turnstile> \<Psi> \<triangleright> ((K\<^sub>1 kills K\<^sub>2) # \<Phi>) \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
[PROOF STEP]
have \<open>\<lbrakk> \<Gamma>, n \<turnstile> ((K\<^sub>1 kills K\<^sub>2) # \<Psi>) \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
        = \<lbrakk>\<lbrakk> \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>

goal (1 subgoal):
 1. \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>

goal (1 subgoal):
 1. \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
[PROOF STEP]
have \<open>\<lbrakk> ((K\<^sub>1 \<not>\<Up> n) # \<Gamma>), n \<turnstile> \<Psi> \<triangleright> ((K\<^sub>1 kills K\<^sub>2) # \<Phi>) \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
                = \<lbrakk>\<lbrakk> (K\<^sub>1 \<not>\<Up> n) # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup>
                  \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>

goal (1 subgoal):
 1. \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>

goal (1 subgoal):
 1. \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
[PROOF STEP]
have \<open>\<lbrakk> ((K\<^sub>1 \<Up> n) # (K\<^sub>2 \<not>\<Up> \<ge> n) # \<Gamma>), n \<turnstile> \<Psi> \<triangleright> ((K\<^sub>1 kills K\<^sub>2) # \<Phi>) \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
                = \<lbrakk>\<lbrakk> (K\<^sub>1 \<Up> n) # (K\<^sub>2 \<not>\<Up> \<ge> n) # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup>
                  \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>

goal (1 subgoal):
 1. \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>
\<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>
\<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>
\<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>
\<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>

goal (1 subgoal):
 1. \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>\<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>; \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>; \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>\<rbrakk> \<Longrightarrow> \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
[PROOF STEP]
have \<open>\<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup>
            = (\<lbrakk> (K\<^sub>1 \<not>\<Up> n) \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<union> \<lbrakk> (K\<^sub>1 \<Up> n) \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk> (K\<^sub>2 \<not>\<Up> \<ge> n) \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m)
              \<inter> \<lbrakk> (K\<^sub>1 kills K\<^sub>2) \<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup>\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> = (\<lbrakk> K\<^sub>1 \<not>\<Up> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<union> \<lbrakk> K\<^sub>1 \<Up> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk> K\<^sub>2 \<not>\<Up> \<ge> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m) \<inter> \<lbrakk> K\<^sub>1 kills K\<^sub>2 \<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup>
[PROOF STEP]
using TESL_interp_stepwise_kills_coind_unfold
              TESL_interpretation_stepwise_cons_morph
[PROOF STATE]
proof (prove)
using this:
\<lbrakk> ?K\<^sub>1 kills ?K\<^sub>2 \<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> ?n\<^esup> = (\<lbrakk> ?K\<^sub>1 \<not>\<Up> ?n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<union> \<lbrakk> ?K\<^sub>1 \<Up> ?n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk> ?K\<^sub>2 \<not>\<Up> \<ge> ?n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m) \<inter> \<lbrakk> ?K\<^sub>1 kills ?K\<^sub>2 \<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc ?n\<^esup>
\<lbrakk> ?\<phi> \<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> ?n\<^esup> \<inter> \<lbrakk>\<lbrakk> ?\<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> ?n\<^esup> = \<lbrakk>\<lbrakk> ?\<phi> # ?\<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> ?n\<^esup>

goal (1 subgoal):
 1. \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> = (\<lbrakk> K\<^sub>1 \<not>\<Up> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<union> \<lbrakk> K\<^sub>1 \<Up> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk> K\<^sub>2 \<not>\<Up> \<ge> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m) \<inter> \<lbrakk> K\<^sub>1 kills K\<^sub>2 \<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> = (\<lbrakk> K\<^sub>1 \<not>\<Up> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<union> \<lbrakk> K\<^sub>1 \<Up> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk> K\<^sub>2 \<not>\<Up> \<ge> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m) \<inter> \<lbrakk> K\<^sub>1 kills K\<^sub>2 \<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup>

goal (1 subgoal):
 1. \<lbrakk>\<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>; \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>; \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk>\<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma> \<rbrakk>\<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> \<inter> \<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup>\<rbrakk> \<Longrightarrow> \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup> = (\<lbrakk> K\<^sub>1 \<not>\<Up> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<union> \<lbrakk> K\<^sub>1 \<Up> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m \<inter> \<lbrakk> K\<^sub>2 \<not>\<Up> \<ge> n \<rbrakk>\<^sub>p\<^sub>r\<^sub>i\<^sub>m) \<inter> \<lbrakk> K\<^sub>1 kills K\<^sub>2 \<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> Suc n\<^esup> \<inter> \<lbrakk>\<lbrakk> \<Psi> \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L\<^bsup>\<ge> n\<^esup>

goal (1 subgoal):
 1. \<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk> \<Gamma>, n \<turnstile> (K\<^sub>1 kills K\<^sub>2) # \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g = \<lbrakk> K\<^sub>1 \<not>\<Up> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g \<union> \<lbrakk> K\<^sub>1 \<Up> n # K\<^sub>2 \<not>\<Up> \<ge> n # \<Gamma>, n \<turnstile> \<Psi> \<triangleright> (K\<^sub>1 kills K\<^sub>2) # \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma InitSucState_Conf_StepConf:
  "\<lbrakk> TS \<in> HPT ST; S \<in> StepConf (HA ST) (Conf ST) TS;
     S \<notin> Target TS; A \<in> the (CompFun (HA ST) S);
     S \<in> Conf ST; S \<in> ChiStar (HA ST) `` (Source TS) \<rbrakk> \<Longrightarrow>
     InitState A \<in> StepConf (HA ST) (Conf ST) TS"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>TS \<in> HPT ST; S \<in> StepConf (HA ST) (Conf ST) TS; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; S \<in> ChiStar (HA ST) `` Source TS\<rbrakk> \<Longrightarrow> InitState A \<in> StepConf (HA ST) (Conf ST) TS
[PROOF STEP]
apply (frule Conf_HAStates2 [THEN CompFun_HAInitStates_HAStates])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>TS \<in> HPT ST; S \<in> StepConf (HA ST) (Conf ST) TS; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; S \<in> ChiStar (HA ST) `` Source TS\<rbrakk> \<Longrightarrow> ?SA \<in> the (CompFun (HA ST) S)
 2. \<lbrakk>TS \<in> HPT ST; S \<in> StepConf (HA ST) (Conf ST) TS; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; S \<in> ChiStar (HA ST) `` Source TS; InitState ?SA \<in> HAInitStates (HA ST)\<rbrakk> \<Longrightarrow> InitState A \<in> StepConf (HA ST) (Conf ST) TS
[PROOF STEP]
apply fast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>TS \<in> HPT ST; S \<in> StepConf (HA ST) (Conf ST) TS; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; S \<in> ChiStar (HA ST) `` Source TS; InitState A \<in> HAInitStates (HA ST)\<rbrakk> \<Longrightarrow> InitState A \<in> StepConf (HA ST) (Conf ST) TS
[PROOF STEP]
apply (subst (asm) StepConf_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>TS \<in> HPT ST; S \<in> Conf ST - ChiStar (HA ST) `` Source TS \<union> Target TS \<union> ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST) \<union> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+ `` (ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST)); S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; S \<in> ChiStar (HA ST) `` Source TS; InitState A \<in> HAInitStates (HA ST)\<rbrakk> \<Longrightarrow> InitState A \<in> StepConf (HA ST) (Conf ST) TS
[PROOF STEP]
apply safe
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (x, S) \<in> ChiStar (HA ST); x \<in> Source TS; S \<in> Conf ST; S \<notin> ChiStar (HA ST) `` Source TS\<rbrakk> \<Longrightarrow> InitState A \<in> StepConf (HA ST) (Conf ST) TS
 2. \<And>x xa. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (x, S) \<in> ChiStar (HA ST); x \<in> Source TS; S \<in> HAInitStates (HA ST); (xa, S) \<in> ChiRel (HA ST); xa \<in> Target TS\<rbrakk> \<Longrightarrow> InitState A \<in> StepConf (HA ST) (Conf ST) TS
 3. \<And>x xa xb. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (x, S) \<in> ChiStar (HA ST); x \<in> Source TS; (xa, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; xa \<in> HAInitStates (HA ST); (xb, xa) \<in> ChiRel (HA ST); xb \<in> Target TS\<rbrakk> \<Longrightarrow> InitState A \<in> StepConf (HA ST) (Conf ST) TS
[PROOF STEP]
apply fast
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x xa. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (x, S) \<in> ChiStar (HA ST); x \<in> Source TS; S \<in> HAInitStates (HA ST); (xa, S) \<in> ChiRel (HA ST); xa \<in> Target TS\<rbrakk> \<Longrightarrow> InitState A \<in> StepConf (HA ST) (Conf ST) TS
 2. \<And>x xa xb. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (x, S) \<in> ChiStar (HA ST); x \<in> Source TS; (xa, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; xa \<in> HAInitStates (HA ST); (xb, xa) \<in> ChiRel (HA ST); xb \<in> Target TS\<rbrakk> \<Longrightarrow> InitState A \<in> StepConf (HA ST) (Conf ST) TS
[PROOF STEP]
apply (unfold StepConf_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x xa. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (x, S) \<in> ChiStar (HA ST); x \<in> Source TS; S \<in> HAInitStates (HA ST); (xa, S) \<in> ChiRel (HA ST); xa \<in> Target TS\<rbrakk> \<Longrightarrow> InitState A \<in> Conf ST - ChiStar (HA ST) `` Source TS \<union> Target TS \<union> ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST) \<union> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+ `` (ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST))
 2. \<And>x xa xb. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (x, S) \<in> ChiStar (HA ST); x \<in> Source TS; (xa, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; xa \<in> HAInitStates (HA ST); (xb, xa) \<in> ChiRel (HA ST); xb \<in> Target TS\<rbrakk> \<Longrightarrow> InitState A \<in> Conf ST - ChiStar (HA ST) `` Source TS \<union> Target TS \<union> ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST) \<union> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+ `` (ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST))
[PROOF STEP]
apply (fast intro:HAInitStates_InitState_trancl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x xa xb. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (x, S) \<in> ChiStar (HA ST); x \<in> Source TS; (xa, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; xa \<in> HAInitStates (HA ST); (xb, xa) \<in> ChiRel (HA ST); xb \<in> Target TS\<rbrakk> \<Longrightarrow> InitState A \<in> Conf ST - ChiStar (HA ST) `` Source TS \<union> Target TS \<union> ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST) \<union> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+ `` (ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST))
[PROOF STEP]
apply (rename_tac T U V)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>T U V. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS\<rbrakk> \<Longrightarrow> InitState A \<in> Conf ST - ChiStar (HA ST) `` Source TS \<union> Target TS \<union> ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST) \<union> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+ `` (ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST))
[PROOF STEP]
apply (frule trancl_Int_mem, fold ChiPlus_def, safe)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>T U V. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+ `` (ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST)); InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); InitState A \<notin> Conf ST\<rbrakk> \<Longrightarrow> InitState A \<in> ChiRel (HA ST) `` Target TS
 2. \<And>T U V x. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+ `` (ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST)); InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); (x, InitState A) \<in> ChiStar (HA ST); x \<in> Source TS; \<not> False\<rbrakk> \<Longrightarrow> InitState A \<in> ChiRel (HA ST) `` Target TS
[PROOF STEP]
apply (subst (asm) Image_def, safe)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>T U V. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); InitState A \<notin> Conf ST; InitState A \<notin> ChiRel (HA ST) `` Target TS\<rbrakk> \<Longrightarrow> \<exists>x\<in>ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST). (x, InitState A) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+
 2. \<And>T U V x. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+ `` (ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST)); InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); (x, InitState A) \<in> ChiStar (HA ST); x \<in> Source TS; \<not> False\<rbrakk> \<Longrightarrow> InitState A \<in> ChiRel (HA ST) `` Target TS
[PROOF STEP]
apply (rule_tac x=U in bexI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>T U V. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); InitState A \<notin> Conf ST; InitState A \<notin> ChiRel (HA ST) `` Target TS\<rbrakk> \<Longrightarrow> (U, InitState A) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+
 2. \<And>T U V. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); InitState A \<notin> Conf ST; InitState A \<notin> ChiRel (HA ST) `` Target TS\<rbrakk> \<Longrightarrow> U \<in> ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST)
 3. \<And>T U V x. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+ `` (ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST)); InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); (x, InitState A) \<in> ChiStar (HA ST); x \<in> Source TS; \<not> False\<rbrakk> \<Longrightarrow> InitState A \<in> ChiRel (HA ST) `` Target TS
[PROOF STEP]
apply (simp only: ChiPlus_HAStates_Right [THEN HAInitStates_InitState_trancl2])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>T U V. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); InitState A \<notin> Conf ST; InitState A \<notin> ChiRel (HA ST) `` Target TS\<rbrakk> \<Longrightarrow> U \<in> ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST)
 2. \<And>T U V x. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+ `` (ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST)); InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); (x, InitState A) \<in> ChiStar (HA ST); x \<in> Source TS; \<not> False\<rbrakk> \<Longrightarrow> InitState A \<in> ChiRel (HA ST) `` Target TS
[PROOF STEP]
apply fast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>T U V x. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+ `` (ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST)); InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); (x, InitState A) \<in> ChiStar (HA ST); x \<in> Source TS; \<not> False\<rbrakk> \<Longrightarrow> InitState A \<in> ChiRel (HA ST) `` Target TS
[PROOF STEP]
apply (subst (asm) Image_def, safe)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>T U V x. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); (x, InitState A) \<in> ChiStar (HA ST); x \<in> Source TS; \<not> False; InitState A \<notin> ChiRel (HA ST) `` Target TS\<rbrakk> \<Longrightarrow> \<exists>x\<in>ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST). (x, InitState A) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+
[PROOF STEP]
apply (rule_tac x=U in bexI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>T U V x. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); (x, InitState A) \<in> ChiStar (HA ST); x \<in> Source TS; \<not> False; InitState A \<notin> ChiRel (HA ST) `` Target TS\<rbrakk> \<Longrightarrow> (U, InitState A) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+
 2. \<And>T U V x. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); (x, InitState A) \<in> ChiStar (HA ST); x \<in> Source TS; \<not> False; InitState A \<notin> ChiRel (HA ST) `` Target TS\<rbrakk> \<Longrightarrow> U \<in> ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST)
[PROOF STEP]
apply (simp only: ChiPlus_HAStates_Right [THEN HAInitStates_InitState_trancl2])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>T U V x. \<lbrakk>TS \<in> HPT ST; S \<notin> Target TS; A \<in> the (CompFun (HA ST) S); S \<in> Conf ST; InitState A \<in> HAInitStates (HA ST); (T, S) \<in> ChiStar (HA ST); T \<in> Source TS; (U, S) \<in> (Restr (ChiRel (HA ST)) (HAInitStates (HA ST)))\<^sup>+; U \<in> HAInitStates (HA ST); (V, U) \<in> ChiRel (HA ST); V \<in> Target TS; InitState A \<notin> Target TS; (U, S) \<in> ChiPlus (HA ST); U \<in> HAInitStates (HA ST); S \<in> HAInitStates (HA ST); (x, InitState A) \<in> ChiStar (HA ST); x \<in> Source TS; \<not> False; InitState A \<notin> ChiRel (HA ST) `` Target TS\<rbrakk> \<Longrightarrow> U \<in> ChiRel (HA ST) `` Target TS \<inter> HAInitStates (HA ST)
[PROOF STEP]
apply fast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "\<not> p2 n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> p2 n
[PROOF STEP]
nitpick [expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> p2 n
[PROOF STEP]
nitpick [dont_star_linear_preds, expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> p2 n
[PROOF STEP]
sorry


[STATEMENT]
lemma A_authenticates_and_keydist_to_Tgs:
 "\<lbrakk>  Gets A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace>)
       \<in> set evs;
     Gets A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>)
       \<in> set evs;
     Key authK \<notin> analz (spies evs); A \<notin> bad;
     evs \<in> kerbIV_gets \<rbrakk>
 \<Longrightarrow> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>)
       \<in> set evs
  \<and> Key authK \<in> analz (knows Tgs evs)
  \<and> Key servK \<in> analz (knows Tgs evs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Gets A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evs; Gets A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs; Key authK \<notin> analz (knows Spy evs); A \<notin> bad; evs \<in> kerbIV_gets\<rbrakk> \<Longrightarrow> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs \<and> Key authK \<in> analz (knows Tgs evs) \<and> Key servK \<in> analz (knows Tgs evs)
[PROOF STEP]
apply (drule Gets_imp_knows_Spy [THEN parts.Inj], assumption)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Gets A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs; Key authK \<notin> analz (knows Spy evs); A \<notin> bad; evs \<in> kerbIV_gets; Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace> \<in> parts (knows Spy evs)\<rbrakk> \<Longrightarrow> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs \<and> Key authK \<in> analz (knows Tgs evs) \<and> Key servK \<in> analz (knows Tgs evs)
[PROOF STEP]
apply (drule Gets_imp_knows_Spy [THEN parts.Inj], assumption)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Key authK \<notin> analz (knows Spy evs); A \<notin> bad; evs \<in> kerbIV_gets; Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace> \<in> parts (knows Spy evs); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs)\<rbrakk> \<Longrightarrow> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs \<and> Key authK \<in> analz (knows Tgs evs) \<and> Key servK \<in> analz (knows Tgs evs)
[PROOF STEP]
apply (frule authK_authentic, assumption+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Key authK \<notin> analz (knows Spy evs); A \<notin> bad; evs \<in> kerbIV_gets; Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace> \<in> parts (knows Spy evs); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs); Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evs\<rbrakk> \<Longrightarrow> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs \<and> Key authK \<in> analz (knows Tgs evs) \<and> Key servK \<in> analz (knows Tgs evs)
[PROOF STEP]
apply (drule servK_authentic_ter, assumption+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Key authK \<notin> analz (knows Spy evs); A \<notin> bad; evs \<in> kerbIV_gets; Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace> \<in> parts (knows Spy evs); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs); Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs\<rbrakk> \<Longrightarrow> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs \<and> Key authK \<in> analz (knows Tgs evs) \<and> Key servK \<in> analz (knows Tgs evs)
[PROOF STEP]
apply (frule K4_imp_Gets, assumption, erule exE, erule exE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Taa X. \<lbrakk>Key authK \<notin> analz (knows Spy evs); A \<notin> bad; evs \<in> kerbIV_gets; Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace> \<in> parts (knows Spy evs); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs); Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs; Gets Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Taa\<rbrace>, X\<rbrace> \<in> set evs\<rbrakk> \<Longrightarrow> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs \<and> Key authK \<in> analz (knows Tgs evs) \<and> Key servK \<in> analz (knows Tgs evs)
[PROOF STEP]
apply (drule Gets_imp_knows [THEN analz.Inj, THEN analz.Fst, THEN analz.Decrypt, THEN analz.Snd, THEN analz.Snd, THEN analz.Fst], assumption, force)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Taa X. \<lbrakk>Key authK \<notin> analz (knows Spy evs); A \<notin> bad; evs \<in> kerbIV_gets; Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace> \<in> parts (knows Spy evs); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs); Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs; Key authK \<in> analz (knows Tgs evs)\<rbrakk> \<Longrightarrow> Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs \<and> Key authK \<in> analz (knows Tgs evs) \<and> Key servK \<in> analz (knows Tgs evs)
[PROOF STEP]
apply (metis Says_imp_knows analz.Fst analz.Inj analz_symKeys_Decrypt authTicket_form)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma mk_op_rl2:
    assumes "\<And>x y. mf x y \<equiv> ASSERT (P x y) \<then> RETURN (f x y)"
    shows "(uncurry mf, uncurry (RETURN oo f)) \<in> [uncurry P]\<^sub>f Id\<times>\<^sub>rId \<rightarrow> \<langle>Id\<rangle>nres_rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (uncurry mf, uncurry (RETURN \<circ>\<circ> f)) \<in> [uncurry P]\<^sub>f Id \<times>\<^sub>r Id \<rightarrow> \<langle>Id\<rangle>nres_rel
[PROOF STEP]
apply (intro frefI nres_relI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x y. \<lbrakk>uncurry P y; (x, y) \<in> Id \<times>\<^sub>r Id\<rbrakk> \<Longrightarrow> uncurry mf x \<le> \<Down> Id (uncurry (RETURN \<circ>\<circ> f) y)
[PROOF STEP]
apply (auto simp: assms)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done