[STATEMENT]
lemma opnet_sync_action_subnet_oreachable:
  assumes "(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2))
                                         (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)))"
          (is "_ \<in> oreachable _ (?S (p\<^sub>1 \<parallel> p\<^sub>2)) (?U (p\<^sub>1 \<parallel> p\<^sub>2))")

      and "\<And>\<xi>. U \<xi> \<xi>"

      and act1: "opnet onp p\<^sub>1 \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. oarrivemsg I \<sigma>, other U (net_tree_ips p\<^sub>1) \<rightarrow>)
                   globala (\<lambda>(\<sigma>, a, \<sigma>'). castmsg (I \<sigma>) a
                                          \<and> (a = \<tau> \<or> (\<exists>i d. a = i:deliver(d)) \<longrightarrow>
                                                 ((\<forall>i\<in>net_tree_ips p\<^sub>1. U (\<sigma> i) (\<sigma>' i))
                                               \<and> (\<forall>i. i\<notin>net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' i = \<sigma> i))))"

      and act2: "opnet onp p\<^sub>2 \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. oarrivemsg I \<sigma>, other U (net_tree_ips p\<^sub>2) \<rightarrow>)
                   globala (\<lambda>(\<sigma>, a, \<sigma>'). castmsg (I \<sigma>) a
                                          \<and> (a = \<tau> \<or> (\<exists>i d. a = i:deliver(d)) \<longrightarrow>
                                                 ((\<forall>i\<in>net_tree_ips p\<^sub>2. U (\<sigma> i) (\<sigma>' i))
                                               \<and> (\<forall>i. i\<notin>net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' i = \<sigma> i))))"

    shows "(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1))
           \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2))
           \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
using assms(1)
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)))

goal (1 subgoal):
 1. (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
proof (induction rule: oreachable_par_subnet_induct)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>\<sigma> s t. (\<sigma>, SubnetS s t) \<in> init (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) \<Longrightarrow> (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 3. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
case (init \<sigma> s t)
[PROOF STATE]
proof (state)
this:
(\<sigma>, SubnetS s t) \<in> init (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2))

goal (3 subgoals):
 1. \<And>\<sigma> s t. (\<sigma>, SubnetS s t) \<in> init (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) \<Longrightarrow> (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 3. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
hence sinit: "(\<sigma>, s) \<in> init (opnet onp p\<^sub>1)"
      and tinit: "(\<sigma>, t) \<in> init (opnet onp p\<^sub>2)"
      and "net_ips s \<inter> net_ips t = {}"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, SubnetS s t) \<in> init (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2))

goal (1 subgoal):
 1. (\<sigma>, s) \<in> init (opnet onp p\<^sub>1) &&& (\<sigma>, t) \<in> init (opnet onp p\<^sub>2) &&& net_ips s \<inter> net_ips t = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<sigma>, s) \<in> init (opnet onp p\<^sub>1)
(\<sigma>, t) \<in> init (opnet onp p\<^sub>2)
net_ips s \<inter> net_ips t = {}

goal (3 subgoals):
 1. \<And>\<sigma> s t. (\<sigma>, SubnetS s t) \<in> init (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) \<Longrightarrow> (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 3. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<sigma>, s) \<in> init (opnet onp p\<^sub>1)
(\<sigma>, t) \<in> init (opnet onp p\<^sub>2)
net_ips s \<inter> net_ips t = {}

goal (3 subgoals):
 1. \<And>\<sigma> s t. (\<sigma>, SubnetS s t) \<in> init (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) \<Longrightarrow> (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 3. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
from sinit
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> init (opnet onp p\<^sub>1)
[PROOF STEP]
have "net_ips s = net_tree_ips p\<^sub>1"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> init (opnet onp p\<^sub>1)

goal (1 subgoal):
 1. net_ips s = net_tree_ips p\<^sub>1
[PROOF STEP]
by (rule opnet_net_ips_net_tree_ips_init)
[PROOF STATE]
proof (state)
this:
net_ips s = net_tree_ips p\<^sub>1

goal (3 subgoals):
 1. \<And>\<sigma> s t. (\<sigma>, SubnetS s t) \<in> init (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) \<Longrightarrow> (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 3. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
net_ips s = net_tree_ips p\<^sub>1

goal (3 subgoals):
 1. \<And>\<sigma> s t. (\<sigma>, SubnetS s t) \<in> init (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) \<Longrightarrow> (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 3. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
from tinit
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, t) \<in> init (opnet onp p\<^sub>2)
[PROOF STEP]
have "net_ips t = net_tree_ips p\<^sub>2"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, t) \<in> init (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. net_ips t = net_tree_ips p\<^sub>2
[PROOF STEP]
by (rule opnet_net_ips_net_tree_ips_init)
[PROOF STATE]
proof (state)
this:
net_ips t = net_tree_ips p\<^sub>2

goal (3 subgoals):
 1. \<And>\<sigma> s t. (\<sigma>, SubnetS s t) \<in> init (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) \<Longrightarrow> (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 3. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> init (opnet onp p\<^sub>1)
(\<sigma>, t) \<in> init (opnet onp p\<^sub>2)
net_ips s \<inter> net_ips t = {}
net_ips s = net_tree_ips p\<^sub>1
net_ips t = net_tree_ips p\<^sub>2
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> init (opnet onp p\<^sub>1)
(\<sigma>, t) \<in> init (opnet onp p\<^sub>2)
net_ips s \<inter> net_ips t = {}
net_ips s = net_tree_ips p\<^sub>1
net_ips t = net_tree_ips p\<^sub>2

goal (1 subgoal):
 1. (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
by (auto elim: oreachable_init)
[PROOF STATE]
proof (state)
this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}

goal (2 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
case (other \<sigma> s t \<sigma>')
[PROOF STATE]
proof (state)
this:
(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)))
other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}

goal (2 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
hence "other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'"
      and IHs: "(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
      and IHt: "(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
      and "net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)))
other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}

goal (1 subgoal):
 1. (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>' &&& (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))) &&& (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2)) &&& net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}

goal (2 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
have "(\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
from \<open>?U (p\<^sub>1 \<parallel> p\<^sub>2) \<sigma> \<sigma>'\<close> and \<open>\<And>\<xi>. U \<xi> \<xi>\<close>
[PROOF STATE]
proof (chain)
picking this:
other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'
U ?\<xi> ?\<xi>
[PROOF STEP]
have "?U p\<^sub>1 \<sigma> \<sigma>'"
[PROOF STATE]
proof (prove)
using this:
other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'
U ?\<xi> ?\<xi>

goal (1 subgoal):
 1. other U (net_tree_ips p\<^sub>1) \<sigma> \<sigma>'
[PROOF STEP]
by (rule other_net_tree_ips_par_left)
[PROOF STATE]
proof (state)
this:
other U (net_tree_ips p\<^sub>1) \<sigma> \<sigma>'

goal (1 subgoal):
 1. (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
with IHs
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
other U (net_tree_ips p\<^sub>1) \<sigma> \<sigma>'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
other U (net_tree_ips p\<^sub>1) \<sigma> \<sigma>'

goal (1 subgoal):
 1. (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
by - (erule(1) oreachable_other')
[PROOF STATE]
proof (state)
this:
(\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (2 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (2 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
have "(\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from \<open>?U (p\<^sub>1 \<parallel> p\<^sub>2) \<sigma> \<sigma>'\<close> and \<open>\<And>\<xi>. U \<xi> \<xi>\<close>
[PROOF STATE]
proof (chain)
picking this:
other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'
U ?\<xi> ?\<xi>
[PROOF STEP]
have "?U p\<^sub>2 \<sigma> \<sigma>'"
[PROOF STATE]
proof (prove)
using this:
other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'
U ?\<xi> ?\<xi>

goal (1 subgoal):
 1. other U (net_tree_ips p\<^sub>2) \<sigma> \<sigma>'
[PROOF STEP]
by (rule other_net_tree_ips_par_right)
[PROOF STATE]
proof (state)
this:
other U (net_tree_ips p\<^sub>2) \<sigma> \<sigma>'

goal (1 subgoal):
 1. (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
with IHt
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
other U (net_tree_ips p\<^sub>2) \<sigma> \<sigma>'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
other U (net_tree_ips p\<^sub>2) \<sigma> \<sigma>'

goal (1 subgoal):
 1. (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by - (erule(1) oreachable_other')
[PROOF STATE]
proof (state)
this:
(\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (2 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)) \<sigma> \<sigma>'; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
 2. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
using \<open>net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<close>
[PROOF STATE]
proof (prove)
using this:
(\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}

goal (1 subgoal):
 1. (\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<sigma>', s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}

goal (1 subgoal):
 1. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
case (local \<sigma> s t \<sigma>' s' t' a)
[PROOF STATE]
proof (state)
this:
(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)))
((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2))
oarrivemsg I \<sigma> a
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}

goal (1 subgoal):
 1. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
hence stor: "(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (?S (p\<^sub>1 \<parallel> p\<^sub>2)) (?U (p\<^sub>1 \<parallel> p\<^sub>2))"
      and tr: "((\<sigma>, SubnetS s t), a, (\<sigma>', SubnetS s' t')) \<in> trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2))"
      and "oarrivemsg I \<sigma> a"
      and sor: "(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
      and tor: "(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
      and "net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)))
((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2))
oarrivemsg I \<sigma> a
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}

goal (1 subgoal):
 1. ((\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))) &&& ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) &&& oarrivemsg I \<sigma> a) &&& (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) &&& (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2)) &&& net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2)))
((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2))
oarrivemsg I \<sigma> a
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}

goal (1 subgoal):
 1. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
from tr
[PROOF STATE]
proof (chain)
picking this:
((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2))
[PROOF STEP]
have "((\<sigma>, SubnetS s t), a, (\<sigma>', SubnetS s' t'))
                    \<in> opnet_sos (trans (opnet onp p\<^sub>1)) (trans (opnet onp p\<^sub>2))"
[PROOF STATE]
proof (prove)
using this:
((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2))

goal (1 subgoal):
 1. ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> opnet_sos (automaton.trans (opnet onp p\<^sub>1)) (automaton.trans (opnet onp p\<^sub>2))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> opnet_sos (automaton.trans (opnet onp p\<^sub>1)) (automaton.trans (opnet onp p\<^sub>2))

goal (1 subgoal):
 1. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
hence "(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)
         \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> opnet_sos (automaton.trans (opnet onp p\<^sub>1)) (automaton.trans (opnet onp p\<^sub>2))

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
proof (cases)
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>H K m H' K'. \<lbrakk>a = (H \<union> H')\<not>(K \<union> K'):arrive(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H'\<not>K':arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 9. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
fix H K m H' K'
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>H K m H' K'. \<lbrakk>a = (H \<union> H')\<not>(K \<union> K'):arrive(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H'\<not>K':arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 9. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
assume "a = (H \<union> H')\<not>(K \<union> K'):arrive(m)"
         and str: "((\<sigma>, s), H\<not>K:arrive(m), (\<sigma>', s')) \<in> trans (opnet onp p\<^sub>1)"
         and ttr: "((\<sigma>, t), H'\<not>K':arrive(m), (\<sigma>', t')) \<in> trans (opnet onp p\<^sub>2)"
[PROOF STATE]
proof (state)
this:
a = (H \<union> H')\<not>(K \<union> K'):arrive(m)
((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, t), H'\<not>K':arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (9 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>H K m H' K'. \<lbrakk>a = (H \<union> H')\<not>(K \<union> K'):arrive(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H'\<not>K':arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 9. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from this(1) and \<open>oarrivemsg I \<sigma> a\<close>
[PROOF STATE]
proof (chain)
picking this:
a = (H \<union> H')\<not>(K \<union> K'):arrive(m)
oarrivemsg I \<sigma> a
[PROOF STEP]
have "I \<sigma> m"
[PROOF STATE]
proof (prove)
using this:
a = (H \<union> H')\<not>(K \<union> K'):arrive(m)
oarrivemsg I \<sigma> a

goal (1 subgoal):
 1. I \<sigma> m
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
I \<sigma> m

goal (9 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>H K m H' K'. \<lbrakk>a = (H \<union> H')\<not>(K \<union> K'):arrive(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H'\<not>K':arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 9. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
with sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
I \<sigma> m
[PROOF STEP]
have "(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
I \<sigma> m

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (9 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>H K m H' K'. \<lbrakk>a = (H \<union> H')\<not>(K \<union> K'):arrive(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H'\<not>K':arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 9. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (9 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>H K m H' K'. \<lbrakk>a = (H \<union> H')\<not>(K \<union> K'):arrive(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H'\<not>K':arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 9. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from \<open>I \<sigma> m\<close> tor ttr
[PROOF STATE]
proof (chain)
picking this:
I \<sigma> m
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), H'\<not>K':arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
I \<sigma> m
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), H'\<not>K':arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (9 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>H K m H' K'. \<lbrakk>a = (H \<union> H')\<not>(K \<union> K'):arrive(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H'\<not>K':arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 9. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (8 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
fix R m H K
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
assume str: "((\<sigma>, s), R:*cast(m), (\<sigma>', s')) \<in> trans (opnet onp p\<^sub>1)"
         and ttr: "((\<sigma>, t), H\<not>K:arrive(m), (\<sigma>', t')) \<in> trans (opnet onp p\<^sub>2)"
[PROOF STATE]
proof (state)
this:
((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (8 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
[PROOF STEP]
have "I \<sigma> m"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)

goal (1 subgoal):
 1. I \<sigma> m
[PROOF STEP]
by - (drule(1) ostep_invariantD [OF act1], simp_all)
[PROOF STATE]
proof (state)
this:
I \<sigma> m

goal (8 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
with sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
I \<sigma> m
[PROOF STEP]
have "(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
I \<sigma> m

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (8 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (8 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from \<open>I \<sigma> m\<close> tor ttr
[PROOF STATE]
proof (chain)
picking this:
I \<sigma> m
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
I \<sigma> m
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (8 subgoals):
 1. \<And>R m H K. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), R:*cast(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), H\<not>K:arrive(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 8. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (7 subgoals):
 1. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
fix R m H K
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
assume str: "((\<sigma>, s), H\<not>K:arrive(m), (\<sigma>', s')) \<in> trans (opnet onp p\<^sub>1)"
         and ttr: "((\<sigma>, t), R:*cast(m), (\<sigma>', t')) \<in> trans (opnet onp p\<^sub>2)"
[PROOF STATE]
proof (state)
this:
((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (7 subgoals):
 1. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from tor ttr
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "I \<sigma> m"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. I \<sigma> m
[PROOF STEP]
by - (drule(1) ostep_invariantD [OF act2], simp_all)
[PROOF STATE]
proof (state)
this:
I \<sigma> m

goal (7 subgoals):
 1. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
with sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
I \<sigma> m
[PROOF STEP]
have "(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
I \<sigma> m

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (7 subgoals):
 1. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (7 subgoals):
 1. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from \<open>I \<sigma> m\<close> tor ttr
[PROOF STATE]
proof (chain)
picking this:
I \<sigma> m
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
I \<sigma> m
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (7 subgoals):
 1. \<And>H K m R. \<lbrakk>a = R:*cast(m); ((\<sigma>, s), H\<not>K:arrive(m), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), R:*cast(m), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2); H \<subseteq> R; K \<inter> R = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 7. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (6 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
fix i i'
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
assume str: "((\<sigma>, s), connect(i, i'), (\<sigma>', s')) \<in> trans (opnet onp p\<^sub>1)"
         and ttr: "((\<sigma>, t), connect(i, i'), (\<sigma>', t')) \<in> trans (opnet onp p\<^sub>2)"
[PROOF STATE]
proof (state)
this:
((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (6 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
with sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (6 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (6 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from tor ttr
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (6 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = connect(i, i'); ((\<sigma>, s), connect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), connect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 6. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (5 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
fix i i'
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
assume str: "((\<sigma>, s), disconnect(i, i'), (\<sigma>', s')) \<in> trans (opnet onp p\<^sub>1)"
         and ttr: "((\<sigma>, t), disconnect(i, i'), (\<sigma>', t')) \<in> trans (opnet onp p\<^sub>2)"
[PROOF STATE]
proof (state)
this:
((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (5 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
with sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (5 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (5 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from tor ttr
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (5 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 5. \<And>i i'. \<lbrakk>a = disconnect(i, i'); ((\<sigma>, s), disconnect(i, i'), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1); ((\<sigma>, t), disconnect(i, i'), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
fix i d
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
assume "t' = t"
         and str: "((\<sigma>, s), i:deliver(d), (\<sigma>', s')) \<in> trans (opnet onp p\<^sub>1)"
[PROOF STATE]
proof (state)
this:
t' = t
((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)

goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
[PROOF STEP]
have "\<forall>j. j\<notin>net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)

goal (1 subgoal):
 1. \<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
by - (drule(1) ostep_invariantD [OF act1], simp_all)
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
with \<open>net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<close>
[PROOF STATE]
proof (chain)
picking this:
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
have "\<forall>j. j\<in>net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j"
[PROOF STATE]
proof (prove)
using this:
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (1 subgoal):
 1. \<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
[PROOF STEP]
have "\<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)

goal (1 subgoal):
 1. \<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)
[PROOF STEP]
by - (drule(1) ostep_invariantD [OF act1], simp_all)
[PROOF STATE]
proof (state)
this:
\<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)

goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)
[PROOF STEP]
have "(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)

goal (1 subgoal):
 1. (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
using tor \<open>t' = t\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
t' = t

goal (1 subgoal):
 1. (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by (clarsimp elim!: oreachable_other')
                              (metis otherI \<open>\<And>\<xi>. U \<xi> \<xi>\<close>)+
[PROOF STATE]
proof (state)
this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
[PROOF STEP]
have "(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (4 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); t' = t; ((\<sigma>, s), i:deliver(d), \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 4. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by (rule conjI [rotated])
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
fix i d
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
assume "s' = s"
         and ttr: "((\<sigma>, t), i:deliver(d), (\<sigma>', t')) \<in> trans (opnet onp p\<^sub>2)"
[PROOF STATE]
proof (state)
this:
s' = s
((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from tor ttr
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "\<forall>j. j\<notin>net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. \<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
by - (drule(1) ostep_invariantD [OF act2], simp_all)
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
with \<open>net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<close>
[PROOF STATE]
proof (chain)
picking this:
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
have "\<forall>j. j\<in>net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j"
[PROOF STATE]
proof (prove)
using this:
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (1 subgoal):
 1. \<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from tor ttr
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "\<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. \<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)
[PROOF STEP]
by - (drule(1) ostep_invariantD [OF act2], simp_all)
[PROOF STATE]
proof (state)
this:
\<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)

goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)
[PROOF STEP]
have "(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
using sor \<open>s' = s\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
s' = s

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
by (clarsimp elim!: oreachable_other')
                              (metis otherI \<open>\<And>\<xi>. U \<xi> \<xi>\<close>)+
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from tor ttr
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (3 subgoals):
 1. \<And>i d. \<lbrakk>a = i:deliver(d); s' = s; ((\<sigma>, t), i:deliver(d), \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 3. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (2 subgoals):
 1. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
assume "t' = t"
         and str: "((\<sigma>, s), \<tau>, (\<sigma>', s')) \<in> trans (opnet onp p\<^sub>1)"
[PROOF STATE]
proof (state)
this:
t' = t
((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)

goal (2 subgoals):
 1. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
[PROOF STEP]
have "\<forall>j. j\<notin>net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)

goal (1 subgoal):
 1. \<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
by - (drule(1) ostep_invariantD [OF act1], simp_all)
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (2 subgoals):
 1. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (2 subgoals):
 1. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
with \<open>net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<close>
[PROOF STATE]
proof (chain)
picking this:
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
have "\<forall>j. j\<in>net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j"
[PROOF STATE]
proof (prove)
using this:
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (1 subgoal):
 1. \<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (2 subgoals):
 1. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (2 subgoals):
 1. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
[PROOF STEP]
have "\<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)

goal (1 subgoal):
 1. \<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)
[PROOF STEP]
by - (drule(1) ostep_invariantD [OF act1], simp_all)
[PROOF STATE]
proof (state)
this:
\<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)

goal (2 subgoals):
 1. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)
[PROOF STEP]
have "(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)

goal (1 subgoal):
 1. (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
using tor \<open>t' = t\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>1. U (\<sigma> j) (\<sigma>' j)
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
t' = t

goal (1 subgoal):
 1. (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by (clarsimp elim!: oreachable_other')
                              (metis otherI \<open>\<And>\<xi>. U \<xi> \<xi>\<close>)+
[PROOF STATE]
proof (state)
this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (2 subgoals):
 1. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (2 subgoals):
 1. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from sor str
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)
[PROOF STEP]
have "(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (2 subgoals):
 1. \<lbrakk>a = \<tau>; t' = t; ((\<sigma>, s), \<tau>, \<sigma>', s') \<in> automaton.trans (opnet onp p\<^sub>1)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
 2. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by (rule conjI [rotated])
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
assume "s' = s"
         and ttr: "((\<sigma>, t), \<tau>, (\<sigma>', t')) \<in> trans (opnet onp p\<^sub>2)"
[PROOF STATE]
proof (state)
this:
s' = s
((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from tor ttr
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "\<forall>j. j\<notin>net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. \<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
by - (drule(1) ostep_invariantD [OF act2], simp_all)
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (1 subgoal):
 1. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (1 subgoal):
 1. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
with \<open>net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<close>
[PROOF STATE]
proof (chain)
picking this:
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
have "\<forall>j. j\<in>net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j"
[PROOF STATE]
proof (prove)
using this:
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (1 subgoal):
 1. \<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (1 subgoal):
 1. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j

goal (1 subgoal):
 1. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from tor ttr
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "\<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. \<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)
[PROOF STEP]
by - (drule(1) ostep_invariantD [OF act2], simp_all)
[PROOF STATE]
proof (state)
this:
\<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)

goal (1 subgoal):
 1. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)
[PROOF STEP]
have "(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (?S p\<^sub>1) (?U p\<^sub>1)"
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
using sor \<open>s' = s\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<notin> net_tree_ips p\<^sub>2 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j. j \<in> net_tree_ips p\<^sub>1 \<longrightarrow> \<sigma>' j = \<sigma> j
\<forall>j\<in>net_tree_ips p\<^sub>2. U (\<sigma> j) (\<sigma>' j)
(\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
s' = s

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
[PROOF STEP]
by (clarsimp elim!: oreachable_other')
                              (metis otherI \<open>\<And>\<xi>. U \<xi> \<xi>\<close>)+
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (1 subgoal):
 1. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))

goal (1 subgoal):
 1. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
from tor ttr
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)
[PROOF STEP]
have "(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (?S p\<^sub>2) (?U p\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)

goal (1 subgoal):
 1. (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
by - (erule(1) oreachable_local, auto)
[PROOF STATE]
proof (state)
this:
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. \<lbrakk>a = \<tau>; s' = s; ((\<sigma>, t), \<tau>, \<sigma>', t') \<in> automaton.trans (opnet onp p\<^sub>2)\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1))
(\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. \<And>\<sigma> s t \<sigma>' s' t' a. \<lbrakk>(\<sigma>, SubnetS s t) \<in> oreachable (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips (p\<^sub>1 \<parallel> p\<^sub>2))); ((\<sigma>, SubnetS s t), a, \<sigma>', SubnetS s' t') \<in> automaton.trans (opnet onp (p\<^sub>1 \<parallel> p\<^sub>2)); oarrivemsg I \<sigma> a; (\<sigma>, s) \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>, t) \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<rbrakk> \<Longrightarrow> (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
with \<open>net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}\<close>
[PROOF STATE]
proof (chain)
picking this:
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>a b. oarrivemsg I a) (other U (net_tree_ips p\<^sub>2))

goal (1 subgoal):
 1. (\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<sigma>', s') \<in> oreachable (opnet onp p\<^sub>1) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>1)) \<and> (\<sigma>', t') \<in> oreachable (opnet onp p\<^sub>2) (\<lambda>\<sigma> _. oarrivemsg I \<sigma>) (other U (net_tree_ips p\<^sub>2)) \<and> net_tree_ips p\<^sub>1 \<inter> net_tree_ips p\<^sub>2 = {}

goal:
No subgoals!
[PROOF STEP]
qed