[STATEMENT]
lemma Can_red:
    assumes "Ide u"
    shows "Can (u\<^bold>\<down>)" and "u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Can (u\<^bold>\<down>) &&& u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. Can (u\<^bold>\<down>)
 2. u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>
[PROOF STEP]
have 0: "Ide u \<Longrightarrow> Can (u\<^bold>\<down>) \<and> u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Ide u \<Longrightarrow> Can (u\<^bold>\<down>) \<and> u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>
[PROOF STEP]
proof (induct u, simp_all add: Dom_Ide Cod_Ide)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u1 u2. \<lbrakk>Can (u1\<^bold>\<down>) \<and> Arr (u1\<^bold>\<down>) \<and> Dom (u1\<^bold>\<down>) = u1 \<and> Cod (u1\<^bold>\<down>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor>; Can (u2\<^bold>\<down>) \<and> Arr (u2\<^bold>\<down>) \<and> Dom (u2\<^bold>\<down>) = u2 \<and> Cod (u2\<^bold>\<down>) = \<^bold>\<lfloor>u2\<^bold>\<rfloor>; Ide u1 \<and> Ide u2 \<and> Src u1 = Trg u2\<rbrakk> \<Longrightarrow> (Nml (u1 \<^bold>\<star> u2) \<longrightarrow> Can u1 \<and> Can u2 \<and> u1 \<^bold>\<star> u2 = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> (\<not> Nml (u1 \<^bold>\<star> u2) \<longrightarrow> Can (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> Src (u1\<^bold>\<down>) = Trg (u2\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>u2\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> Src (u1\<^bold>\<down>) = Trg (u2\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>u2\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>u2\<^bold>\<rfloor>)
[PROOF STEP]
fix v w
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u1 u2. \<lbrakk>Can (u1\<^bold>\<down>) \<and> Arr (u1\<^bold>\<down>) \<and> Dom (u1\<^bold>\<down>) = u1 \<and> Cod (u1\<^bold>\<down>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor>; Can (u2\<^bold>\<down>) \<and> Arr (u2\<^bold>\<down>) \<and> Dom (u2\<^bold>\<down>) = u2 \<and> Cod (u2\<^bold>\<down>) = \<^bold>\<lfloor>u2\<^bold>\<rfloor>; Ide u1 \<and> Ide u2 \<and> Src u1 = Trg u2\<rbrakk> \<Longrightarrow> (Nml (u1 \<^bold>\<star> u2) \<longrightarrow> Can u1 \<and> Can u2 \<and> u1 \<^bold>\<star> u2 = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> (\<not> Nml (u1 \<^bold>\<star> u2) \<longrightarrow> Can (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> Src (u1\<^bold>\<down>) = Trg (u2\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>u2\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> Src (u1\<^bold>\<down>) = Trg (u2\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>u2\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>u2\<^bold>\<rfloor>)
[PROOF STEP]
assume v: "Can (v\<^bold>\<down>) \<and> Arr (v\<^bold>\<down>) \<and> Dom (v\<^bold>\<down>) = v \<and> Cod (v\<^bold>\<down>) = \<^bold>\<lfloor>v\<^bold>\<rfloor>"
[PROOF STATE]
proof (state)
this:
Can (v\<^bold>\<down>) \<and> Arr (v\<^bold>\<down>) \<and> Dom (v\<^bold>\<down>) = v \<and> Cod (v\<^bold>\<down>) = \<^bold>\<lfloor>v\<^bold>\<rfloor>

goal (1 subgoal):
 1. \<And>u1 u2. \<lbrakk>Can (u1\<^bold>\<down>) \<and> Arr (u1\<^bold>\<down>) \<and> Dom (u1\<^bold>\<down>) = u1 \<and> Cod (u1\<^bold>\<down>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor>; Can (u2\<^bold>\<down>) \<and> Arr (u2\<^bold>\<down>) \<and> Dom (u2\<^bold>\<down>) = u2 \<and> Cod (u2\<^bold>\<down>) = \<^bold>\<lfloor>u2\<^bold>\<rfloor>; Ide u1 \<and> Ide u2 \<and> Src u1 = Trg u2\<rbrakk> \<Longrightarrow> (Nml (u1 \<^bold>\<star> u2) \<longrightarrow> Can u1 \<and> Can u2 \<and> u1 \<^bold>\<star> u2 = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> (\<not> Nml (u1 \<^bold>\<star> u2) \<longrightarrow> Can (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> Src (u1\<^bold>\<down>) = Trg (u2\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>u2\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> Src (u1\<^bold>\<down>) = Trg (u2\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>u2\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>u2\<^bold>\<rfloor>)
[PROOF STEP]
assume w: "Can (w\<^bold>\<down>) \<and> Arr (w\<^bold>\<down>) \<and> Dom (w\<^bold>\<down>) = w \<and> Cod (w\<^bold>\<down>) = \<^bold>\<lfloor>w\<^bold>\<rfloor>"
[PROOF STATE]
proof (state)
this:
Can (w\<^bold>\<down>) \<and> Arr (w\<^bold>\<down>) \<and> Dom (w\<^bold>\<down>) = w \<and> Cod (w\<^bold>\<down>) = \<^bold>\<lfloor>w\<^bold>\<rfloor>

goal (1 subgoal):
 1. \<And>u1 u2. \<lbrakk>Can (u1\<^bold>\<down>) \<and> Arr (u1\<^bold>\<down>) \<and> Dom (u1\<^bold>\<down>) = u1 \<and> Cod (u1\<^bold>\<down>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor>; Can (u2\<^bold>\<down>) \<and> Arr (u2\<^bold>\<down>) \<and> Dom (u2\<^bold>\<down>) = u2 \<and> Cod (u2\<^bold>\<down>) = \<^bold>\<lfloor>u2\<^bold>\<rfloor>; Ide u1 \<and> Ide u2 \<and> Src u1 = Trg u2\<rbrakk> \<Longrightarrow> (Nml (u1 \<^bold>\<star> u2) \<longrightarrow> Can u1 \<and> Can u2 \<and> u1 \<^bold>\<star> u2 = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> (\<not> Nml (u1 \<^bold>\<star> u2) \<longrightarrow> Can (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> Src (u1\<^bold>\<down>) = Trg (u2\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>u2\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> Src (u1\<^bold>\<down>) = Trg (u2\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>u2\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>u2\<^bold>\<rfloor>)
[PROOF STEP]
assume vw: "Ide v \<and> Ide w \<and> Src v = Trg w"
[PROOF STATE]
proof (state)
this:
Ide v \<and> Ide w \<and> Src v = Trg w

goal (1 subgoal):
 1. \<And>u1 u2. \<lbrakk>Can (u1\<^bold>\<down>) \<and> Arr (u1\<^bold>\<down>) \<and> Dom (u1\<^bold>\<down>) = u1 \<and> Cod (u1\<^bold>\<down>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor>; Can (u2\<^bold>\<down>) \<and> Arr (u2\<^bold>\<down>) \<and> Dom (u2\<^bold>\<down>) = u2 \<and> Cod (u2\<^bold>\<down>) = \<^bold>\<lfloor>u2\<^bold>\<rfloor>; Ide u1 \<and> Ide u2 \<and> Src u1 = Trg u2\<rbrakk> \<Longrightarrow> (Nml (u1 \<^bold>\<star> u2) \<longrightarrow> Can u1 \<and> Can u2 \<and> u1 \<^bold>\<star> u2 = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> (\<not> Nml (u1 \<^bold>\<star> u2) \<longrightarrow> Can (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> Src (u1\<^bold>\<down>) = Trg (u2\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>u2\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) \<and> Src (u1\<^bold>\<down>) = Trg (u2\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>u2\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>u2\<^bold>\<rfloor>) = \<^bold>\<lfloor>u1\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>u2\<^bold>\<rfloor>)
[PROOF STEP]
show "(Nml (v \<^bold>\<star> w) \<longrightarrow>
                 Can v \<and> Can w \<and> v \<^bold>\<star> w = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and>
              (\<not> Nml (v \<^bold>\<star> w) \<longrightarrow>
                 Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and>
                 Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and>
                 Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (Nml (v \<^bold>\<star> w) \<longrightarrow> Can v \<and> Can w \<and> v \<^bold>\<star> w = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> (\<not> Nml (v \<^bold>\<star> w) \<longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. Nml (v \<^bold>\<star> w) \<longrightarrow> Can v \<and> Can w \<and> v \<^bold>\<star> w = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
 2. \<not> Nml (v \<^bold>\<star> w) \<longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
show "Nml (v \<^bold>\<star> w) \<longrightarrow>
                  Can v \<and> Can w \<and> v \<^bold>\<star> w = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Nml (v \<^bold>\<star> w) \<longrightarrow> Can v \<and> Can w \<and> v \<^bold>\<star> w = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
using vw Nml_HcompD Ide_implies_Can Dom_Inv VcompNml_Ide_Nml Inv_Ide
                  Nmlize.simps(3) Nmlize_Nml
[PROOF STATE]
proof (prove)
using this:
Ide v \<and> Ide w \<and> Src v = Trg w
Nml (?t \<^bold>\<star> ?u) \<Longrightarrow> \<^bold>\<langle>un_Prim ?t\<^bold>\<rangle> = ?t
Nml (?t \<^bold>\<star> ?u) \<Longrightarrow> arr (un_Prim ?t)
Nml (?t \<^bold>\<star> ?u) \<Longrightarrow> Nml ?t
Nml (?t \<^bold>\<star> ?u) \<Longrightarrow> Nml ?u
Nml (?t \<^bold>\<star> ?u) \<Longrightarrow> \<not> is_Prim\<^sub>0 ?u
Nml (?t \<^bold>\<star> ?u) \<Longrightarrow> \<^bold>\<langle>src (un_Prim ?t)\<^bold>\<rangle>\<^sub>0 = Trg ?u
Nml (?t \<^bold>\<star> ?u) \<Longrightarrow> Src ?t = Trg ?u
Ide ?t \<Longrightarrow> Can ?t
Can ?t \<Longrightarrow> Dom (Inv ?t) = Cod ?t
\<lbrakk>Nml ?t; Ide ?a; Dom ?a = Cod ?t\<rbrakk> \<Longrightarrow> ?a \<^bold>\<lfloor>\<^bold>\<cdot>\<^bold>\<rfloor> ?t = ?t
Ide ?a \<Longrightarrow> Inv ?a = ?a
\<^bold>\<lfloor>?t \<^bold>\<star> ?u\<^bold>\<rfloor> = \<^bold>\<lfloor>?t\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>?u\<^bold>\<rfloor>
Nml ?t \<Longrightarrow> \<^bold>\<lfloor>?t\<^bold>\<rfloor> = ?t

goal (1 subgoal):
 1. Nml (v \<^bold>\<star> w) \<longrightarrow> Can v \<and> Can w \<and> v \<^bold>\<star> w = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
Nml (v \<^bold>\<star> w) \<longrightarrow> Can v \<and> Can w \<and> v \<^bold>\<star> w = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>

goal (1 subgoal):
 1. \<not> Nml (v \<^bold>\<star> w) \<longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
show "\<not> Nml (v \<^bold>\<star> w) \<longrightarrow>
                  Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and>
                  Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and>
                  Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> Nml (v \<^bold>\<star> w) \<longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> Nml (v \<^bold>\<star> w) \<Longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
assume 1: "\<not> Nml (v \<^bold>\<star> w)"
[PROOF STATE]
proof (state)
this:
\<not> Nml (v \<^bold>\<star> w)

goal (1 subgoal):
 1. \<not> Nml (v \<^bold>\<star> w) \<Longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
have "Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>)
[PROOF STEP]
using v w vw Can_red2 Nml_Nmlize Ide_Nmlize_Ide Nml_HcompNml Ide_HcompNml
[PROOF STATE]
proof (prove)
using this:
Can (v\<^bold>\<down>) \<and> Arr (v\<^bold>\<down>) \<and> Dom (v\<^bold>\<down>) = v \<and> Cod (v\<^bold>\<down>) = \<^bold>\<lfloor>v\<^bold>\<rfloor>
Can (w\<^bold>\<down>) \<and> Arr (w\<^bold>\<down>) \<and> Dom (w\<^bold>\<down>) = w \<and> Cod (w\<^bold>\<down>) = \<^bold>\<lfloor>w\<^bold>\<rfloor>
Ide v \<and> Ide w \<and> Src v = Trg w
\<lbrakk>Ide ?a; Nml ?a; Ide ?b; Nml ?b; Src ?a = Trg ?b\<rbrakk> \<Longrightarrow> Can (?a \<^bold>\<Down> ?b)
\<lbrakk>Ide ?a; Nml ?a; Ide ?b; Nml ?b; Src ?a = Trg ?b\<rbrakk> \<Longrightarrow> ?a \<^bold>\<Down> ?b \<in> VHom (?a \<^bold>\<star> ?b) \<^bold>\<lfloor>?a \<^bold>\<star> ?b\<^bold>\<rfloor>
Arr ?t \<Longrightarrow> Nml \<^bold>\<lfloor>?t\<^bold>\<rfloor>
Arr ?t \<Longrightarrow> Src \<^bold>\<lfloor>?t\<^bold>\<rfloor> = Src ?t
Arr ?t \<Longrightarrow> Trg \<^bold>\<lfloor>?t\<^bold>\<rfloor> = Trg ?t
Arr ?t \<Longrightarrow> Dom \<^bold>\<lfloor>?t\<^bold>\<rfloor> = \<^bold>\<lfloor>Dom ?t\<^bold>\<rfloor>
Arr ?t \<Longrightarrow> Cod \<^bold>\<lfloor>?t\<^bold>\<rfloor> = \<^bold>\<lfloor>Cod ?t\<^bold>\<rfloor>
Ide ?t \<Longrightarrow> Ide \<^bold>\<lfloor>?t\<^bold>\<rfloor>
\<lbrakk>Nml ?t; Nml ?u; Src ?t = Trg ?u\<rbrakk> \<Longrightarrow> Nml (?t \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> ?u)
\<lbrakk>Nml ?t; Nml ?u; Src ?t = Trg ?u\<rbrakk> \<Longrightarrow> Dom (?t \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> ?u) = Dom ?t \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> Dom ?u
\<lbrakk>Nml ?t; Nml ?u; Src ?t = Trg ?u\<rbrakk> \<Longrightarrow> Cod (?t \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> ?u) = Cod ?t \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> Cod ?u
\<lbrakk>Nml ?t; Nml ?u; Src ?t = Trg ?u\<rbrakk> \<Longrightarrow> Src (?t \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> ?u) = Src ?u
\<lbrakk>Nml ?t; Nml ?u; Src ?t = Trg ?u\<rbrakk> \<Longrightarrow> Trg (?t \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> ?u) = Trg ?t
\<lbrakk>Ide ?t; Ide ?u; Nml ?t; Nml ?u; Src ?t = Trg ?u\<rbrakk> \<Longrightarrow> Ide (?t \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> ?u)

goal (1 subgoal):
 1. Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>)

goal (1 subgoal):
 1. \<not> Nml (v \<^bold>\<star> w) \<Longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>)

goal (1 subgoal):
 1. \<not> Nml (v \<^bold>\<star> w) \<Longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
have "Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>)
[PROOF STEP]
using v w vw Src_Dom Trg_Dom
[PROOF STATE]
proof (prove)
using this:
Can (v\<^bold>\<down>) \<and> Arr (v\<^bold>\<down>) \<and> Dom (v\<^bold>\<down>) = v \<and> Cod (v\<^bold>\<down>) = \<^bold>\<lfloor>v\<^bold>\<rfloor>
Can (w\<^bold>\<down>) \<and> Arr (w\<^bold>\<down>) \<and> Dom (w\<^bold>\<down>) = w \<and> Cod (w\<^bold>\<down>) = \<^bold>\<lfloor>w\<^bold>\<rfloor>
Ide v \<and> Ide w \<and> Src v = Trg w
Arr ?t \<Longrightarrow> Src (Dom ?t) = Src ?t
Arr ?t \<Longrightarrow> Trg (Dom ?t) = Trg ?t

goal (1 subgoal):
 1. Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>)
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>)

goal (1 subgoal):
 1. \<not> Nml (v \<^bold>\<star> w) \<Longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>)

goal (1 subgoal):
 1. \<not> Nml (v \<^bold>\<star> w) \<Longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
have "Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
using v w vw Can_red2 Nml_Nmlize Ide_Nmlize_Ide
[PROOF STATE]
proof (prove)
using this:
Can (v\<^bold>\<down>) \<and> Arr (v\<^bold>\<down>) \<and> Dom (v\<^bold>\<down>) = v \<and> Cod (v\<^bold>\<down>) = \<^bold>\<lfloor>v\<^bold>\<rfloor>
Can (w\<^bold>\<down>) \<and> Arr (w\<^bold>\<down>) \<and> Dom (w\<^bold>\<down>) = w \<and> Cod (w\<^bold>\<down>) = \<^bold>\<lfloor>w\<^bold>\<rfloor>
Ide v \<and> Ide w \<and> Src v = Trg w
\<lbrakk>Ide ?a; Nml ?a; Ide ?b; Nml ?b; Src ?a = Trg ?b\<rbrakk> \<Longrightarrow> Can (?a \<^bold>\<Down> ?b)
\<lbrakk>Ide ?a; Nml ?a; Ide ?b; Nml ?b; Src ?a = Trg ?b\<rbrakk> \<Longrightarrow> ?a \<^bold>\<Down> ?b \<in> VHom (?a \<^bold>\<star> ?b) \<^bold>\<lfloor>?a \<^bold>\<star> ?b\<^bold>\<rfloor>
Arr ?t \<Longrightarrow> Nml \<^bold>\<lfloor>?t\<^bold>\<rfloor>
Arr ?t \<Longrightarrow> Src \<^bold>\<lfloor>?t\<^bold>\<rfloor> = Src ?t
Arr ?t \<Longrightarrow> Trg \<^bold>\<lfloor>?t\<^bold>\<rfloor> = Trg ?t
Arr ?t \<Longrightarrow> Dom \<^bold>\<lfloor>?t\<^bold>\<rfloor> = \<^bold>\<lfloor>Dom ?t\<^bold>\<rfloor>
Arr ?t \<Longrightarrow> Cod \<^bold>\<lfloor>?t\<^bold>\<rfloor> = \<^bold>\<lfloor>Cod ?t\<^bold>\<rfloor>
Ide ?t \<Longrightarrow> Ide \<^bold>\<lfloor>?t\<^bold>\<rfloor>

goal (1 subgoal):
 1. Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>

goal (1 subgoal):
 1. \<not> Nml (v \<^bold>\<star> w) \<Longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>)
Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>)
Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
show "Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and>
                             Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and>
                             Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and>
                             Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>"
[PROOF STATE]
proof (prove)
using this:
Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>)
Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>)
Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>

goal (1 subgoal):
 1. Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
using Can_implies_Arr
[PROOF STATE]
proof (prove)
using this:
Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>)
Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>)
Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
Can ?t \<Longrightarrow> Arr ?t

goal (1 subgoal):
 1. Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<not> Nml (v \<^bold>\<star> w) \<longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(Nml (v \<^bold>\<star> w) \<longrightarrow> Can v \<and> Can w \<and> v \<^bold>\<star> w = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> (\<not> Nml (v \<^bold>\<star> w) \<longrightarrow> Can (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Arr (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) \<and> Src (v\<^bold>\<down>) = Trg (w\<^bold>\<down>) \<and> Dom (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<star> \<^bold>\<lfloor>w\<^bold>\<rfloor> \<and> Cod (\<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<Down> \<^bold>\<lfloor>w\<^bold>\<rfloor>) = \<^bold>\<lfloor>v\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor> \<^bold>\<lfloor>w\<^bold>\<rfloor>)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
Ide u \<Longrightarrow> Can (u\<^bold>\<down>) \<and> u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>

goal (2 subgoals):
 1. Can (u\<^bold>\<down>)
 2. u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>
[PROOF STEP]
show "Can (u\<^bold>\<down>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Can (u\<^bold>\<down>)
[PROOF STEP]
using assms 0
[PROOF STATE]
proof (prove)
using this:
Ide u
Ide u \<Longrightarrow> Can (u\<^bold>\<down>) \<and> u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>

goal (1 subgoal):
 1. Can (u\<^bold>\<down>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Can (u\<^bold>\<down>)

goal (1 subgoal):
 1. u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>
[PROOF STEP]
show "u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>
[PROOF STEP]
using assms 0
[PROOF STATE]
proof (prove)
using this:
Ide u
Ide u \<Longrightarrow> Can (u\<^bold>\<down>) \<and> u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>

goal (1 subgoal):
 1. u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
u\<^bold>\<down> \<in> VHom u \<^bold>\<lfloor>u\<^bold>\<rfloor>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Outpts_A_Card_unique_key: "\<lbrakk> Outpts (Card A) A \<lbrace>Key K, V\<rbrace> \<in> set evs;
         Outpts (Card A') A' \<lbrace>Key K, V'\<rbrace> \<in> set evs;
         evs \<in> sr \<rbrakk> \<Longrightarrow> A=A' \<and> V=V'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Outpts (Card A) A \<lbrace>Key K, V\<rbrace> \<in> set evs; Outpts (Card A') A' \<lbrace>Key K, V'\<rbrace> \<in> set evs; evs \<in> sr\<rbrakk> \<Longrightarrow> A = A' \<and> V = V'
[PROOF STEP]
apply (erule rev_mp, erule rev_mp, erule sr.induct, simp_all)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evs10 Aa Ka Nb B Na. \<lbrakk>evs10 \<in> sr; Outpts (Card A') A' \<lbrace>Key K, V'\<rbrace> \<in> set evs10 \<longrightarrow> Outpts (Card A) A \<lbrace>Key K, V\<rbrace> \<in> set evs10 \<longrightarrow> A = A' \<and> V = V'; Card Aa \<notin> stolen; Aa \<noteq> Server; Ka = sesK (Nb, pairK (Aa, B)); Inputs Aa (Card Aa) \<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce (Pairkey (Aa, B)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, B)), Agent B\<rbrace>, Crypt (pairK (Aa, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> \<in> set evs10\<rbrakk> \<Longrightarrow> (A' = Aa \<and> K = sesK (Nb, pairK (Aa, B)) \<and> V' = Crypt (pairK (Aa, B)) (Nonce Nb) \<longrightarrow> Outpts (Card A) A \<lbrace>Key (sesK (Nb, pairK (Aa, B))), V\<rbrace> \<in> set evs10 \<longrightarrow> A = Aa \<and> V = Crypt (pairK (Aa, B)) (Nonce Nb)) \<and> (Outpts (Card A') A' \<lbrace>Key K, V'\<rbrace> \<in> set evs10 \<longrightarrow> A = Aa \<and> K = sesK (Nb, pairK (Aa, B)) \<and> V = Crypt (pairK (Aa, B)) (Nonce Nb) \<longrightarrow> Aa = A' \<and> Crypt (pairK (Aa, B)) (Nonce Nb) = V')
 2. \<And>evs10F Aa Ka Nb B Na. \<lbrakk>evs10F \<in> sr; Outpts (Card A') A' \<lbrace>Key K, V'\<rbrace> \<in> set evs10F \<longrightarrow> Outpts (Card A) A \<lbrace>Key K, V\<rbrace> \<in> set evs10F \<longrightarrow> A = A' \<and> V = V'; Card Aa \<in> stolen \<and> Aa \<in> bad \<or> Card Aa \<in> cloned; Ka = sesK (Nb, pairK (Aa, B)); Inputs Spy (Card Aa) \<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce (Pairkey (Aa, B)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, B)), Agent B\<rbrace>, Crypt (pairK (Aa, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> \<in> set evs10F\<rbrakk> \<Longrightarrow> (A' = Aa \<and> A' = Spy \<and> K = sesK (Nb, pairK (Aa, B)) \<and> V' = Crypt (pairK (Aa, B)) (Nonce Nb) \<longrightarrow> Outpts (Card A) A \<lbrace>Key (sesK (Nb, pairK (Aa, B))), V\<rbrace> \<in> set evs10F \<longrightarrow> A = Aa \<and> V = Crypt (pairK (Aa, B)) (Nonce Nb)) \<and> (Outpts (Card A') A' \<lbrace>Key K, V'\<rbrace> \<in> set evs10F \<longrightarrow> A = Aa \<and> A = Spy \<and> K = sesK (Nb, pairK (Aa, B)) \<and> V = Crypt (pairK (Aa, B)) (Nonce Nb) \<longrightarrow> Aa = A' \<and> Crypt (pairK (Aa, B)) (Nonce Nb) = V')
[PROOF STEP]
apply (blast dest: Outpts_A_Card_form_bis)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs10F Aa Ka Nb B Na. \<lbrakk>evs10F \<in> sr; Outpts (Card A') A' \<lbrace>Key K, V'\<rbrace> \<in> set evs10F \<longrightarrow> Outpts (Card A) A \<lbrace>Key K, V\<rbrace> \<in> set evs10F \<longrightarrow> A = A' \<and> V = V'; Card Aa \<in> stolen \<and> Aa \<in> bad \<or> Card Aa \<in> cloned; Ka = sesK (Nb, pairK (Aa, B)); Inputs Spy (Card Aa) \<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce (Pairkey (Aa, B)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, B)), Agent B\<rbrace>, Crypt (pairK (Aa, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> \<in> set evs10F\<rbrakk> \<Longrightarrow> (A' = Aa \<and> A' = Spy \<and> K = sesK (Nb, pairK (Aa, B)) \<and> V' = Crypt (pairK (Aa, B)) (Nonce Nb) \<longrightarrow> Outpts (Card A) A \<lbrace>Key (sesK (Nb, pairK (Aa, B))), V\<rbrace> \<in> set evs10F \<longrightarrow> A = Aa \<and> V = Crypt (pairK (Aa, B)) (Nonce Nb)) \<and> (Outpts (Card A') A' \<lbrace>Key K, V'\<rbrace> \<in> set evs10F \<longrightarrow> A = Aa \<and> A = Spy \<and> K = sesK (Nb, pairK (Aa, B)) \<and> V = Crypt (pairK (Aa, B)) (Nonce Nb) \<longrightarrow> Aa = A' \<and> Crypt (pairK (Aa, B)) (Nonce Nb) = V')
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma R\<^sub>C_ofD:
  assumes rr: "secure_refinement \<R>\<^sub>A \<R> P"
  assumes in_R: "(\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> R\<^sub>C_of \<R>\<^sub>A \<R> P"
  shows
   "(\<exists>c\<^sub>1\<^sub>A c\<^sub>2\<^sub>A.  (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and>
             (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and>
             (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> \<R>\<^sub>A) \<and>
    (mds\<^sub>C' = mds\<^sub>C) \<and>
    conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C \<and>
    (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>c\<^sub>1\<^sub>A c\<^sub>2\<^sub>A. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> \<R>\<^sub>A) \<and> mds\<^sub>C' = mds\<^sub>C \<and> conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<exists>c\<^sub>1\<^sub>A c\<^sub>2\<^sub>A. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> \<R>\<^sub>A) \<and> mds\<^sub>C' = mds\<^sub>C \<and> conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P
[PROOF STEP]
have \<R>_preserves_modes_mem: "preserves_modes_mem \<R>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_modes_mem \<R>
[PROOF STEP]
using rr
[PROOF STATE]
proof (prove)
using this:
secure_refinement \<R>\<^sub>A \<R> P

goal (1 subgoal):
 1. preserves_modes_mem \<R>
[PROOF STEP]
unfolding secure_refinement_def
[PROOF STATE]
proof (prove)
using this:
closed_others \<R> \<and> preserves_modes_mem \<R> \<and> new_vars_private \<R> \<and> conc.closed_glob_consistent P \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<leadsto>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>n c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. abs.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A n \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> \<R> \<and> (\<forall>c\<^sub>2\<^sub>A mem\<^sub>2\<^sub>A c\<^sub>2\<^sub>C mem\<^sub>2\<^sub>C c\<^sub>2\<^sub>A' mem\<^sub>2\<^sub>A'. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A) \<in> \<R>\<^sub>A \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P \<and> abs.neval \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A n \<langle>c\<^sub>2\<^sub>A', mds\<^sub>A', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A \<longrightarrow> (\<exists>c\<^sub>2\<^sub>C' mem\<^sub>2\<^sub>C'. \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C \<leadsto>\<^sub>C \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C \<and> (\<langle>c\<^sub>2\<^sub>A', mds\<^sub>A', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> P)))))

goal (1 subgoal):
 1. preserves_modes_mem \<R>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_modes_mem \<R>

goal (1 subgoal):
 1. (\<exists>c\<^sub>1\<^sub>A c\<^sub>2\<^sub>A. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> \<R>\<^sub>A) \<and> mds\<^sub>C' = mds\<^sub>C \<and> conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P
[PROOF STEP]
from in_R
[PROOF STATE]
proof (chain)
picking this:
(\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> R\<^sub>C_of \<R>\<^sub>A \<R> P
[PROOF STEP]
obtain c\<^sub>1\<^sub>A mds\<^sub>1\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>2\<^sub>A mds\<^sub>2\<^sub>A mem\<^sub>2\<^sub>A where
  in_\<R>\<^sub>1: "(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R>" and
  in_\<R>\<^sub>2: "(\<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R>" and
  in_\<R>\<^sub>A: "(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A) \<in> \<R>\<^sub>A" and
  pred_holds: "(\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P" and
  mds_eq: "mds\<^sub>C = mds\<^sub>C'" and
  mds_eq: "conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C"
[PROOF STATE]
proof (prove)
using this:
(\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> R\<^sub>C_of \<R>\<^sub>A \<R> P

goal (1 subgoal):
 1. (\<And>c\<^sub>1\<^sub>A mds\<^sub>1\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>2\<^sub>A mds\<^sub>2\<^sub>A mem\<^sub>2\<^sub>A. \<lbrakk>(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R>; (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R>; (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A) \<in> \<R>\<^sub>A; (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P; mds\<^sub>C = mds\<^sub>C'; conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding R\<^sub>C_of_def
[PROOF STATE]
proof (prove)
using this:
(\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> {(x, y). \<exists>x\<^sub>A y\<^sub>A. (x\<^sub>A, x) \<in> \<R> \<and> (y\<^sub>A, y) \<in> \<R> \<and> (x\<^sub>A, y\<^sub>A) \<in> \<R>\<^sub>A \<and> snd (fst x) = snd (fst y) \<and> conc.low_mds_eq (snd (fst x)) (snd x) (snd y) \<and> (x, y) \<in> P}

goal (1 subgoal):
 1. (\<And>c\<^sub>1\<^sub>A mds\<^sub>1\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>2\<^sub>A mds\<^sub>2\<^sub>A mem\<^sub>2\<^sub>A. \<lbrakk>(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R>; (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R>; (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A) \<in> \<R>\<^sub>A; (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P; mds\<^sub>C = mds\<^sub>C'; conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R>
(\<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R>
(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A) \<in> \<R>\<^sub>A
(\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P
mds\<^sub>C = mds\<^sub>C'
conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C

goal (1 subgoal):
 1. (\<exists>c\<^sub>1\<^sub>A c\<^sub>2\<^sub>A. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> \<R>\<^sub>A) \<and> mds\<^sub>C' = mds\<^sub>C \<and> conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P
[PROOF STEP]
from this \<R>_preserves_modes_mem[simplified preserves_modes_mem_def2, rule_format, OF in_\<R>\<^sub>1] \<R>_preserves_modes_mem[simplified preserves_modes_mem_def2, rule_format, OF in_\<R>\<^sub>2]
[PROOF STATE]
proof (chain)
picking this:
(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R>
(\<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R>
(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A) \<in> \<R>\<^sub>A
(\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P
mds\<^sub>C = mds\<^sub>C'
conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C
mem\<^sub>1\<^sub>A = mem\<^sub>A_of mem\<^sub>1\<^sub>C \<and> mds\<^sub>1\<^sub>A = mds\<^sub>A_of mds\<^sub>C
mem\<^sub>2\<^sub>A = mem\<^sub>A_of mem\<^sub>2\<^sub>C \<and> mds\<^sub>2\<^sub>A = mds\<^sub>A_of mds\<^sub>C'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R>
(\<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R>
(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>1\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>2\<^sub>A, mem\<^sub>2\<^sub>A\<rangle>\<^sub>A) \<in> \<R>\<^sub>A
(\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P
mds\<^sub>C = mds\<^sub>C'
conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C
mem\<^sub>1\<^sub>A = mem\<^sub>A_of mem\<^sub>1\<^sub>C \<and> mds\<^sub>1\<^sub>A = mds\<^sub>A_of mds\<^sub>C
mem\<^sub>2\<^sub>A = mem\<^sub>A_of mem\<^sub>2\<^sub>C \<and> mds\<^sub>2\<^sub>A = mds\<^sub>A_of mds\<^sub>C'

goal (1 subgoal):
 1. (\<exists>c\<^sub>1\<^sub>A c\<^sub>2\<^sub>A. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> \<R>\<^sub>A) \<and> mds\<^sub>C' = mds\<^sub>C \<and> conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>c\<^sub>1\<^sub>A c\<^sub>2\<^sub>A. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> \<R> \<and> (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> \<R>\<^sub>A) \<and> mds\<^sub>C' = mds\<^sub>C \<and> conc.low_mds_eq mds\<^sub>C mem\<^sub>1\<^sub>C mem\<^sub>2\<^sub>C \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C', mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> P

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Spy_analz_priEK:
      "evs \<in> ns_public \<Longrightarrow> (Key (priEK A) \<in> analz (spies evs)) = (A \<in> bad)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. evs \<in> ns_public \<Longrightarrow> (Key (priEK A) \<in> analz (knows Spy evs)) = (A \<in> bad)
[PROOF STEP]
(*apply (auto simp: Spy_see_priEK dest: analz_into_parts)*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. evs \<in> ns_public \<Longrightarrow> (Key (priEK A) \<in> analz (knows Spy evs)) = (A \<in> bad)
[PROOF STEP]
apply (erule ns_public.induct, simp_all)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. (Key (priEK A) \<in> analz (Key ` invKey ` pubK ` bad \<union> Key ` invKey ` pubSK ` bad \<union> Key ` shrK ` bad \<union> Key ` range pubK \<union> Key ` range pubSK)) = (A \<in> bad)
 2. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; (Key (priEK A) \<in> analz (knows Spy evsf)) = (A \<in> bad); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> (Key (priEK A) \<in> analz (insert X (knows Spy evsf))) = (A \<in> bad)
[PROOF STEP]
(*Nil*)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. (Key (priEK A) \<in> analz (Key ` invKey ` pubK ` bad \<union> Key ` invKey ` pubSK ` bad \<union> Key ` shrK ` bad \<union> Key ` range pubK \<union> Key ` range pubSK)) = (A \<in> bad)
 2. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; (Key (priEK A) \<in> analz (knows Spy evsf)) = (A \<in> bad); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> (Key (priEK A) \<in> analz (insert X (knows Spy evsf))) = (A \<in> bad)
[PROOF STEP]
thm analz_image_freshK_simps
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. (Key (priEK A) \<in> analz (Key ` invKey ` pubK ` bad \<union> Key ` invKey ` pubSK ` bad \<union> Key ` shrK ` bad \<union> Key ` range pubK \<union> Key ` range pubSK)) = (A \<in> bad)
 2. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; (Key (priEK A) \<in> analz (knows Spy evsf)) = (A \<in> bad); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> (Key (priEK A) \<in> analz (insert X (knows Spy evsf))) = (A \<in> bad)
[PROOF STEP]
apply (simp add: analz_image_freshK_simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; (Key (priEK A) \<in> analz (knows Spy evsf)) = (A \<in> bad); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> (Key (priEK A) \<in> analz (insert X (knows Spy evsf))) = (A \<in> bad)
[PROOF STEP]
(*Fake*)
(*apply spy_analz would close, alternatively:*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; (Key (priEK A) \<in> analz (knows Spy evsf)) = (A \<in> bad); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> (Key (priEK A) \<in> analz (insert X (knows Spy evsf))) = (A \<in> bad)
[PROOF STEP]
apply (cases "A:bad")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; (Key (priEK A) \<in> analz (knows Spy evsf)) = (A \<in> bad); X \<in> synth (analz (knows Spy evsf)); A \<in> bad\<rbrakk> \<Longrightarrow> (Key (priEK A) \<in> analz (insert X (knows Spy evsf))) = (A \<in> bad)
 2. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; (Key (priEK A) \<in> analz (knows Spy evsf)) = (A \<in> bad); X \<in> synth (analz (knows Spy evsf)); A \<notin> bad\<rbrakk> \<Longrightarrow> (Key (priEK A) \<in> analz (insert X (knows Spy evsf))) = (A \<in> bad)
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; X \<in> synth (analz (knows Spy evsf)); A \<in> bad; Key (priEK A) \<in> analz (knows Spy evsf); A \<in> bad; A \<in> bad\<rbrakk> \<Longrightarrow> Key (priEK A) \<in> analz (insert X (knows Spy evsf))
 2. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; (Key (priEK A) \<in> analz (knows Spy evsf)) = (A \<in> bad); X \<in> synth (analz (knows Spy evsf)); A \<notin> bad\<rbrakk> \<Longrightarrow> (Key (priEK A) \<in> analz (insert X (knows Spy evsf))) = (A \<in> bad)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; X \<in> synth (analz (knows Spy evsf)); Key (priEK A) \<in> analz (knows Spy evsf); A \<in> bad\<rbrakk> \<Longrightarrow> Key (priEK A) \<in> analz (insert X (knows Spy evsf))
 2. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; (Key (priEK A) \<in> analz (knows Spy evsf)) = (A \<in> bad); X \<in> synth (analz (knows Spy evsf)); A \<notin> bad\<rbrakk> \<Longrightarrow> (Key (priEK A) \<in> analz (insert X (knows Spy evsf))) = (A \<in> bad)
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; (Key (priEK A) \<in> analz (knows Spy evsf)) = (A \<in> bad); X \<in> synth (analz (knows Spy evsf)); A \<notin> bad\<rbrakk> \<Longrightarrow> (Key (priEK A) \<in> analz (insert X (knows Spy evsf))) = (A \<in> bad)
[PROOF STEP]
(*Spy knows bad agents' keys since start*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; (Key (priEK A) \<in> analz (knows Spy evsf)) = (A \<in> bad); X \<in> synth (analz (knows Spy evsf)); A \<notin> bad\<rbrakk> \<Longrightarrow> (Key (priEK A) \<in> analz (insert X (knows Spy evsf))) = (A \<in> bad)
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; Key (priEK A) \<notin> analz (knows Spy evsf); X \<in> synth (analz (knows Spy evsf)); A \<notin> bad; Key (priEK A) \<in> analz (insert X (knows Spy evsf))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (drule Fake_analz_insert [THEN subsetD], simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evsf X. \<lbrakk>evsf \<in> ns_public; Key (priEK A) \<notin> analz (knows Spy evsf); A \<notin> bad; Key (priEK A) \<in> analz (insert X (knows Spy evsf)); Key (priEK A) \<in> synth (analz (knows Spy evsf)) \<union> analz (knows Spy evsf \<union> knows Spy evsf)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "\<not> loose t 0 \<Longrightarrow> subst\<^sub>2 \<sigma> t = t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> loose t 0 \<Longrightarrow> subst\<^sub>2 \<sigma> t = t
[PROOF STEP]
nitpick [card = 1-5, expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> loose t 0 \<Longrightarrow> subst\<^sub>2 \<sigma> t = t
[PROOF STEP]
sorry


[STATEMENT]
lemma Read1S_Sim:
  assumes A: " P \<preceq>S Q" and B: "\<And> A. (d A) = c (S A)" and C: "\<And> A. (s' A) = s (S A)"
  shows "a`?`c`\<in>`s \<rightarrow> P \<preceq>S a`?`d`\<in>`s' \<rightarrow> Q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. read1 a (c, c_update) s P \<preceq>S read1 a (d, d_update) s' Q
[PROOF STEP]
using A
[PROOF STATE]
proof (prove)
using this:
P \<preceq>S Q

goal (1 subgoal):
 1. read1 a (c, c_update) s P \<preceq>S read1 a (d, d_update) s' Q
[PROOF STEP]
apply (auto simp: Simulation_def read1_def relation_of_iPrefix design_defs rp_defs)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>aa ba ca. \<lbrakk>\<forall>a b. action.relation_of Q (a, b) \<longrightarrow> action.relation_of P (Simul S a, Simul S b); ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> do_I (\<lambda>A. a (select (d, d_update) A)) (a ` s' (alpha_rp.more A)) (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<and> alpha_rp.more A' = alpha_rp.more A) \<and> tr A \<le> tr A')) (aa, ba); action.relation_of Q (ba, ca)\<rbrakk> \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> do_I (\<lambda>A. a (select (c, c_update) A)) (a ` s (alpha_rp.more A)) (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<and> alpha_rp.more A' = alpha_rp.more A) \<and> tr A \<le> tr A')) ;; action.relation_of P) (Simul S aa, Simul S ca)
[PROOF STEP]
apply (erule_tac x="ba" in allE, erule_tac x="ca" in allE, simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>aa ba ca. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> do_I (\<lambda>A. a (select (d, d_update) A)) (a ` s' (alpha_rp.more A)) (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<and> alpha_rp.more A' = alpha_rp.more A) \<and> tr A \<le> tr A')) (aa, ba); action.relation_of Q (ba, ca); action.relation_of P (Simul S ba, Simul S ca)\<rbrakk> \<Longrightarrow> (((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> do_I (\<lambda>A. a (select (c, c_update) A)) (a ` s (alpha_rp.more A)) (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<and> alpha_rp.more A' = alpha_rp.more A) \<and> tr A \<le> tr A')) ;; action.relation_of P) (Simul S aa, Simul S ca)
[PROOF STEP]
apply (rule_tac b="Simul S ba" in comp_intro)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa ba ca. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> do_I (\<lambda>A. a (select (d, d_update) A)) (a ` s' (alpha_rp.more A)) (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<and> alpha_rp.more A' = alpha_rp.more A) \<and> tr A \<le> tr A')) (aa, ba); action.relation_of Q (ba, ca); action.relation_of P (Simul S ba, Simul S ca)\<rbrakk> \<Longrightarrow> ((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> do_I (\<lambda>A. a (select (c, c_update) A)) (a ` s (alpha_rp.more A)) (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<and> alpha_rp.more A' = alpha_rp.more A) \<and> tr A \<le> tr A')) (Simul S aa, Simul S ba)
 2. \<And>aa ba c. \<lbrakk>((\<lambda>(A, A'). \<not> ok A \<and> tr A \<le> tr A' \<or> ok A' \<and> tr A = tr A' \<and> wait A = wait A' \<and> ref A = ref A' \<and> alpha_rp.more A = alpha_rp.more A') \<triangleleft> wait \<circ> fst \<triangleright>  (\<lambda>(A, A'). (ok A \<and> true (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<longrightarrow> ok A' \<and> do_I (\<lambda>A. a (select (d, d_update) A)) (a ` s' (alpha_rp.more A)) (A\<lparr>tr := []\<rparr>, A'\<lparr>tr := tr A' - tr A\<rparr>) \<and> alpha_rp.more A' = alpha_rp.more A) \<and> tr A \<le> tr A')) (aa, ba); action.relation_of Q (ba, c); action.relation_of P (Simul S ba, Simul S c)\<rbrakk> \<Longrightarrow> action.relation_of P (Simul S ba, Simul S c)
[PROOF STEP]
apply (auto split: cond_splits simp: Simul_def alpha_rp.defs do_I_def select_def B C)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "\<forall>P. P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>P. P
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>P. P
[PROOF STEP]
oops


[STATEMENT]
lemma assoc_in_homs:
    shows "\<guillemotleft>\<mu> \<star> (assoc\<^sub>S\<^sub>B \<nu> \<pi> \<rho>) : \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>"
    and "\<guillemotleft>assoc\<^sub>S\<^sub>B \<mu> (\<nu> \<star> \<pi>) \<rho> : (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>"
    and "\<guillemotleft>assoc\<^sub>S\<^sub>B \<mu> \<nu> \<pi> \<star> \<rho> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>"
    and "\<guillemotleft>assoc\<^sub>S\<^sub>B \<mu> \<nu> (\<pi> \<star> \<rho>) : (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>"
    and "\<guillemotleft>assoc\<^sub>S\<^sub>B (\<mu> \<star> \<nu>) \<pi> \<rho> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<guillemotleft>\<mu> \<star> \<lparr>Chn = \<nu>\<pi>\<rho>.chine_assoc, Dom = Dom ((\<nu> \<star> \<pi>) \<star> \<rho>), Cod = Cod (\<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright> &&& \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>\<pi>_\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>), Cod = Cod (\<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>) &&& \<guillemotleft>\<lparr>Chn = \<mu>\<nu>\<pi>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi>)\<rparr> \<star> \<rho> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright> &&& \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>_\<pi>\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright> &&& \<guillemotleft>\<lparr>Chn = \<mu>\<nu>_\<pi>_\<rho>.chine_assoc, Dom = Dom (((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho>), Cod = Cod ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>)\<rparr> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<guillemotleft>\<mu> \<star> \<lparr>Chn = \<nu>\<pi>\<rho>.chine_assoc, Dom = Dom ((\<nu> \<star> \<pi>) \<star> \<rho>), Cod = Cod (\<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>
 2. \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>\<pi>_\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>), Cod = Cod (\<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>
 3. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>\<pi>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi>)\<rparr> \<star> \<rho> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>
 4. \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>_\<pi>\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>
 5. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>_\<pi>_\<rho>.chine_assoc, Dom = Dom (((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho>), Cod = Cod ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>)\<rparr> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>\<mu> \<star> (assoc\<^sub>S\<^sub>B \<nu> \<pi> \<rho>) : \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<mu> \<star> \<lparr>Chn = \<nu>\<pi>\<rho>.chine_assoc, Dom = Dom ((\<nu> \<star> \<pi>) \<star> \<rho>), Cod = Cod (\<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
using \<mu>\<nu>.composable \<nu>\<pi>.composable \<pi>\<rho>.composable
[PROOF STATE]
proof (prove)
using this:
src \<mu> = trg \<nu>
src \<nu> = trg \<pi>
src \<pi> = trg \<rho>

goal (1 subgoal):
 1. \<guillemotleft>\<mu> \<star> \<lparr>Chn = \<nu>\<pi>\<rho>.chine_assoc, Dom = Dom ((\<nu> \<star> \<pi>) \<star> \<rho>), Cod = Cod (\<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<mu> \<star> \<lparr>Chn = \<nu>\<pi>\<rho>.chine_assoc, Dom = Dom ((\<nu> \<star> \<pi>) \<star> \<rho>), Cod = Cod (\<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>

goal (4 subgoals):
 1. \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>\<pi>_\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>), Cod = Cod (\<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>
 2. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>\<pi>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi>)\<rparr> \<star> \<rho> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>
 3. \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>_\<pi>\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>
 4. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>_\<pi>_\<rho>.chine_assoc, Dom = Dom (((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho>), Cod = Cod ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>)\<rparr> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>assoc\<^sub>S\<^sub>B \<mu> (\<nu> \<star> \<pi>) \<rho> : (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>\<pi>_\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>), Cod = Cod (\<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>
[PROOF STEP]
using assoc_in_hom \<mu>\<nu>.composable \<nu>\<pi>.composable \<pi>\<rho>.composable
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>ide ?f; ide ?g; ide ?h; src ?f = trg ?g; src ?g = trg ?h\<rbrakk> \<Longrightarrow> \<guillemotleft>\<lparr>Chn = three_composable_identity_arrows_of_spans.chine_assoc (\<cdot>) prj0 prj1 ?f ?g ?h, Dom = Dom ((?f \<star> ?g) \<star> ?h), Cod = Cod (?f \<star> ?g \<star> ?h)\<rparr> : (?f \<star> ?g) \<star> ?h \<Rightarrow> ?f \<star> ?g \<star> ?h\<guillemotright>
src \<mu> = trg \<nu>
src \<nu> = trg \<pi>
src \<pi> = trg \<rho>

goal (1 subgoal):
 1. \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>\<pi>_\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>), Cod = Cod (\<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<lparr>Chn = \<mu>_\<nu>\<pi>_\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>), Cod = Cod (\<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho> \<Rightarrow> \<mu> \<star> (\<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>

goal (3 subgoals):
 1. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>\<pi>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi>)\<rparr> \<star> \<rho> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>
 2. \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>_\<pi>\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>
 3. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>_\<pi>_\<rho>.chine_assoc, Dom = Dom (((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho>), Cod = Cod ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>)\<rparr> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>assoc\<^sub>S\<^sub>B \<mu> \<nu> \<pi> \<star> \<rho> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>\<pi>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi>)\<rparr> \<star> \<rho> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>
[PROOF STEP]
using \<mu>\<nu>.composable \<nu>\<pi>.composable \<pi>\<rho>.composable
[PROOF STATE]
proof (prove)
using this:
src \<mu> = trg \<nu>
src \<nu> = trg \<pi>
src \<pi> = trg \<rho>

goal (1 subgoal):
 1. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>\<pi>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi>)\<rparr> \<star> \<rho> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<lparr>Chn = \<mu>\<nu>\<pi>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi>)\<rparr> \<star> \<rho> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu> \<star> \<pi>) \<star> \<rho>\<guillemotright>

goal (2 subgoals):
 1. \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>_\<pi>\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>
 2. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>_\<pi>_\<rho>.chine_assoc, Dom = Dom (((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho>), Cod = Cod ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>)\<rparr> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>assoc\<^sub>S\<^sub>B \<mu> \<nu> (\<pi> \<star> \<rho>) : (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>_\<pi>\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
using \<mu>\<nu>.composable \<nu>\<pi>.composable \<pi>\<rho>.composable
[PROOF STATE]
proof (prove)
using this:
src \<mu> = trg \<nu>
src \<nu> = trg \<pi>
src \<pi> = trg \<rho>

goal (1 subgoal):
 1. \<guillemotleft>\<lparr>Chn = \<mu>_\<nu>_\<pi>\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<lparr>Chn = \<mu>_\<nu>_\<pi>\<rho>.chine_assoc, Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>), Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>)\<rparr> : (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho> \<Rightarrow> \<mu> \<star> \<nu> \<star> \<pi> \<star> \<rho>\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>_\<pi>_\<rho>.chine_assoc, Dom = Dom (((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho>), Cod = Cod ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>)\<rparr> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>assoc\<^sub>S\<^sub>B (\<mu> \<star> \<nu>) \<pi> \<rho> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>_\<pi>_\<rho>.chine_assoc, Dom = Dom (((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho>), Cod = Cod ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>)\<rparr> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
using \<mu>\<nu>.composable \<nu>\<pi>.composable \<pi>\<rho>.composable
[PROOF STATE]
proof (prove)
using this:
src \<mu> = trg \<nu>
src \<nu> = trg \<pi>
src \<pi> = trg \<rho>

goal (1 subgoal):
 1. \<guillemotleft>\<lparr>Chn = \<mu>\<nu>_\<pi>_\<rho>.chine_assoc, Dom = Dom (((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho>), Cod = Cod ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>)\<rparr> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>\<guillemotright>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<lparr>Chn = \<mu>\<nu>_\<pi>_\<rho>.chine_assoc, Dom = Dom (((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho>), Cod = Cod ((\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>)\<rparr> : ((\<mu> \<star> \<nu>) \<star> \<pi>) \<star> \<rho> \<Rightarrow> (\<mu> \<star> \<nu>) \<star> \<pi> \<star> \<rho>\<guillemotright>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma get_shadow_root_put_document [simp]:
  "cast shadow_root_ptr \<noteq> document_ptr
   \<Longrightarrow> get\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t shadow_root_ptr (put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr document h) = get\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t shadow_root_ptr h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cast shadow_root_ptr \<noteq> document_ptr \<Longrightarrow> get shadow_root_ptr (put document_ptr document h) = get shadow_root_ptr h
[PROOF STEP]
by(auto simp add: get\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def put\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def)