[STATEMENT]
lemma FAss_type_sound:
 "[| wf_prog wf_mb G; a = the_Addr a'; (c, fs) = the (h a);
    (G, lT)\<turnstile>v::T'; G\<turnstile>T'\<preceq>ft;
    (G, lT)\<turnstile>aa::Class C;
    field (G,C) fn = Some (fd, ft); h''\<le>|h';
    x' = None --> G,h'\<turnstile>a'::\<preceq> Class C; h'\<le>|h;
    Norm (h, l)::\<preceq>(G, lT); G,h\<turnstile>x::\<preceq>T'; np a' x' = None|] ==>
  h''\<le>|h(a\<mapsto>(c,(fs((fn,fd)\<mapsto>x)))) \<and>
  Norm(h(a\<mapsto>(c,(fs((fn,fd)\<mapsto>x)))), l)::\<preceq>(G, lT) \<and>
  G,h(a\<mapsto>(c,(fs((fn,fd)\<mapsto>x))))\<turnstile>x::\<preceq>T'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wf_prog wf_mb G; a = the_Addr a'; (c, fs) = the (h a); (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; x' = None \<longrightarrow> G,h' \<turnstile> a' ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; np a' x' = None\<rbrakk> \<Longrightarrow> h'' \<le>| h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<and> Norm (h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( drule np_NoneD)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wf_prog wf_mb G; a = the_Addr a'; (c, fs) = the (h a); (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; x' = None \<longrightarrow> G,h' \<turnstile> a' ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None \<and> a' \<noteq> Null\<rbrakk> \<Longrightarrow> h'' \<le>| h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<and> Norm (h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( erule conjE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wf_prog wf_mb G; a = the_Addr a'; (c, fs) = the (h a); (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; x' = None \<longrightarrow> G,h' \<turnstile> a' ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> h'' \<le>| h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<and> Norm (h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wf_prog wf_mb G; a = the_Addr a'; (c, fs) = the (h (the_Addr a')); (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> a' ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> h'' \<le>| h(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<and> Norm (h(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( drule non_np_objD)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>wf_prog wf_mb G; a = the_Addr a'; (c, fs) = the (h (the_Addr a')); (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> a' ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None\<rbrakk> \<Longrightarrow> ?G4,?h4 \<turnstile> a' ::\<preceq> Class ?C4
 2. \<lbrakk>wf_prog wf_mb G; a = the_Addr a'; (c, fs) = the (h (the_Addr a')); (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> a' ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; \<exists>a C' fs. a' = Addr a \<and> ?h4 a = Some (C', fs) \<and> ?G4 \<turnstile> C' \<preceq>C ?C4\<rbrakk> \<Longrightarrow> h'' \<le>| h(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<and> Norm (h(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply(  assumption)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wf_prog wf_mb G; a = the_Addr a'; (c, fs) = the (h (the_Addr a')); (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> a' ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; \<exists>a C' fs. a' = Addr a \<and> h' a = Some (C', fs) \<and> G \<turnstile> C' \<preceq>C C\<rbrakk> \<Longrightarrow> h'' \<le>| h(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<and> Norm (h(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( clarify)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; a = the_Addr (Addr ab); (c, fs) = the (h (the_Addr (Addr ab))); (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr ab ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr ab; h' ab = Some (C', fsa); G \<turnstile> C' \<preceq>C C\<rbrakk> \<Longrightarrow> h'' \<le>| h(the_Addr (Addr ab) \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<and> Norm (h(the_Addr (Addr ab) \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(the_Addr (Addr ab) \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( simp (no_asm_use))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; a = ab; (c, fs) = the (h ab); (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr ab ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr ab; h' ab = Some (C', fsa); G \<turnstile> C' \<preceq>C C\<rbrakk> \<Longrightarrow> h'' \<le>| h(ab \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<and> Norm (h(ab \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(ab \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( frule (1) hext_objD)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; a = ab; (c, fs) = the (h ab); (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr ab ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr ab; h' ab = Some (C', fsa); G \<turnstile> C' \<preceq>C C; \<exists>fs'. h ab = Some (C', fs')\<rbrakk> \<Longrightarrow> h'' \<le>| h(ab \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<and> Norm (h(ab \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(ab \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( erule exE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ab C' fsa fs'. \<lbrakk>wf_prog wf_mb G; a = ab; (c, fs) = the (h ab); (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr ab ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr ab; h' ab = Some (C', fsa); G \<turnstile> C' \<preceq>C C; h ab = Some (C', fs')\<rbrakk> \<Longrightarrow> h'' \<le>| h(ab \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<and> Norm (h(ab \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(ab \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; a = ab; c = C'; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr ab ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr ab; h' ab = Some (C', fsa); G \<turnstile> C' \<preceq>C C; h ab = Some (C', fs)\<rbrakk> \<Longrightarrow> h'' \<le>| h(ab \<mapsto> (C', fs((fn, fd) \<mapsto> x))) \<and> Norm (h(ab \<mapsto> (C', fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(ab \<mapsto> (C', fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( clarify)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> h'' \<le>| h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<and> Norm (h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> h'' \<le>| h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x)))
 2. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> Norm (h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply(  fast elim: hext_trans hext_upd_obj)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> Norm (h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT) \<and> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
apply( rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> Norm (h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT)
 2. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> x ::\<preceq> T'
 2. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> Norm (h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT)
[PROOF STEP]
apply(  fast elim: conf_upd_obj [THEN iffD2])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> Norm (h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))), l) ::\<preceq> (G, lT)
[PROOF STEP]
apply( rule conforms_upd_obj)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> Norm (h, l) ::\<preceq> (G, lT)
 2. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> (c, fs((fn, fd) \<mapsto> x)) \<surd>
 3. \<And>ab C' fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> h \<le>| h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x)))
[PROOF STEP]
apply   auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> (c, fs((fn, fd) \<mapsto> x)) \<surd>
 2. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> h \<le>| h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x)))
[PROOF STEP]
apply(  rule_tac [2] hextI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> (c, fs((fn, fd) \<mapsto> x)) \<surd>
 2. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> \<forall>aa C fsa. h aa = Some (C, fsa) \<longrightarrow> (\<exists>fs'. (h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x)))) aa = Some (C, fs'))
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> \<forall>aa C fsa. h aa = Some (C, fsa) \<longrightarrow> (\<exists>fs'. (h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x)))) aa = Some (C, fs'))
 2. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> (c, fs((fn, fd) \<mapsto> x)) \<surd>
[PROOF STEP]
apply(  force)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> G,h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x))) \<turnstile> (c, fs((fn, fd) \<mapsto> x)) \<surd>
[PROOF STEP]
apply( rule oconf_hext)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> G,?h53 fsa \<turnstile> (c, fs((fn, fd) \<mapsto> x)) \<surd>
 2. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> ?h53 fsa \<le>| h(a \<mapsto> (c, fs((fn, fd) \<mapsto> x)))
[PROOF STEP]
apply(  erule_tac [2] hext_upd_obj)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs)\<rbrakk> \<Longrightarrow> G,h \<turnstile> (c, fs((fn, fd) \<mapsto> x)) \<surd>
[PROOF STEP]
apply (frule wf_prog_ws_prog)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; field (G, C) fn = Some (fd, ft); h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs); ws_prog G\<rbrakk> \<Longrightarrow> G,h \<turnstile> (c, fs((fn, fd) \<mapsto> x)) \<surd>
[PROOF STEP]
apply( drule (2) widen_cfs_fields)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs); ws_prog G; map_of (fields (G, c)) (fn, fd) = Some ft\<rbrakk> \<Longrightarrow> G,h \<turnstile> (c, fs((fn, fd) \<mapsto> x)) \<surd>
[PROOF STEP]
apply( rule oconf_obj [THEN iffD2])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs); ws_prog G; map_of (fields (G, c)) (fn, fd) = Some ft\<rbrakk> \<Longrightarrow> \<forall>T f. map_of (fields (G, c)) f = Some T \<longrightarrow> (\<exists>v. (fs((fn, fd) \<mapsto> x)) f = Some v \<and> G,h \<turnstile> v ::\<preceq> T)
[PROOF STEP]
apply( simp (no_asm))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>fsa. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs); ws_prog G; map_of (fields (G, c)) (fn, fd) = Some ft\<rbrakk> \<Longrightarrow> \<forall>T a b. (a = fn \<and> b = fd \<longrightarrow> map_of (fields (G, c)) (fn, fd) = Some T \<longrightarrow> G,h \<turnstile> x ::\<preceq> T) \<and> ((a = fn \<longrightarrow> b \<noteq> fd) \<longrightarrow> map_of (fields (G, c)) (a, b) = Some T \<longrightarrow> (\<exists>v. fs (a, b) = Some v \<and> G,h \<turnstile> v ::\<preceq> T))
[PROOF STEP]
apply( intro strip)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>fsa T ab b. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs); ws_prog G; map_of (fields (G, c)) (fn, fd) = Some ft\<rbrakk> \<Longrightarrow> (ab = fn \<and> b = fd \<longrightarrow> map_of (fields (G, c)) (fn, fd) = Some T \<longrightarrow> G,h \<turnstile> x ::\<preceq> T) \<and> ((ab = fn \<longrightarrow> b \<noteq> fd) \<longrightarrow> map_of (fields (G, c)) (ab, b) = Some T \<longrightarrow> (\<exists>v. fs (ab, b) = Some v \<and> G,h \<turnstile> v ::\<preceq> T))
[PROOF STEP]
apply( case_tac "(ab, b) = (fn, fd)")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>fsa T ab b. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs); ws_prog G; map_of (fields (G, c)) (fn, fd) = Some ft; (ab, b) = (fn, fd)\<rbrakk> \<Longrightarrow> (ab = fn \<and> b = fd \<longrightarrow> map_of (fields (G, c)) (fn, fd) = Some T \<longrightarrow> G,h \<turnstile> x ::\<preceq> T) \<and> ((ab = fn \<longrightarrow> b \<noteq> fd) \<longrightarrow> map_of (fields (G, c)) (ab, b) = Some T \<longrightarrow> (\<exists>v. fs (ab, b) = Some v \<and> G,h \<turnstile> v ::\<preceq> T))
 2. \<And>fsa T ab b. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs); ws_prog G; map_of (fields (G, c)) (fn, fd) = Some ft; (ab, b) \<noteq> (fn, fd)\<rbrakk> \<Longrightarrow> (ab = fn \<and> b = fd \<longrightarrow> map_of (fields (G, c)) (fn, fd) = Some T \<longrightarrow> G,h \<turnstile> x ::\<preceq> T) \<and> ((ab = fn \<longrightarrow> b \<noteq> fd) \<longrightarrow> map_of (fields (G, c)) (ab, b) = Some T \<longrightarrow> (\<exists>v. fs (ab, b) = Some v \<and> G,h \<turnstile> v ::\<preceq> T))
[PROOF STEP]
apply(  simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>fsa T ab. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs); ws_prog G; map_of (fields (G, c)) (fn, fd) = Some ft; ab = fn\<rbrakk> \<Longrightarrow> ft = T \<longrightarrow> G,h \<turnstile> x ::\<preceq> T
 2. \<And>fsa T ab b. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs); ws_prog G; map_of (fields (G, c)) (fn, fd) = Some ft; (ab, b) \<noteq> (fn, fd)\<rbrakk> \<Longrightarrow> (ab = fn \<and> b = fd \<longrightarrow> map_of (fields (G, c)) (fn, fd) = Some T \<longrightarrow> G,h \<turnstile> x ::\<preceq> T) \<and> ((ab = fn \<longrightarrow> b \<noteq> fd) \<longrightarrow> map_of (fields (G, c)) (ab, b) = Some T \<longrightarrow> (\<exists>v. fs (ab, b) = Some v \<and> G,h \<turnstile> v ::\<preceq> T))
[PROOF STEP]
apply(  fast intro: conf_widen)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>fsa T ab b. \<lbrakk>wf_prog wf_mb G; (G, lT) \<turnstile> v :: T'; G \<turnstile> T' \<preceq> ft; (G, lT) \<turnstile> aa :: Class C; h'' \<le>| h'; G,h' \<turnstile> Addr a ::\<preceq> Class C; h' \<le>| h; Norm (h, l) ::\<preceq> (G, lT); G,h \<turnstile> x ::\<preceq> T'; x' = None; a' = Addr a; h' a = Some (c, fsa); G \<turnstile> c \<preceq>C C; h a = Some (c, fs); ws_prog G; map_of (fields (G, c)) (fn, fd) = Some ft; (ab, b) \<noteq> (fn, fd)\<rbrakk> \<Longrightarrow> (ab = fn \<and> b = fd \<longrightarrow> map_of (fields (G, c)) (fn, fd) = Some T \<longrightarrow> G,h \<turnstile> x ::\<preceq> T) \<and> ((ab = fn \<longrightarrow> b \<noteq> fd) \<longrightarrow> map_of (fields (G, c)) (ab, b) = Some T \<longrightarrow> (\<exists>v. fs (ab, b) = Some v \<and> G,h \<turnstile> v ::\<preceq> T))
[PROOF STEP]
apply( fast dest: conforms_heapD [THEN hconfD] oconf_objD)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma mem_val_alt_8_mem_equal_2: "mem_equal s1 s2 pa \<Longrightarrow>
mem_val_alt 8 ((pa AND 68719476732) + 2) s1 = mem_val_alt 8 ((pa AND 68719476732) + 2) s2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem_equal s1 s2 pa \<Longrightarrow> mem_val_alt 8 ((pa AND 68719476732) + 2) s1 = mem_val_alt 8 ((pa AND 68719476732) + 2) s2
[PROOF STEP]
apply (simp add: mem_val_alt_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem_equal s1 s2 pa \<Longrightarrow> (let r1 = mem s1 8 ((pa AND 68719476732) + 2) in if r1 = None then let r2 = mem s1 9 ((pa AND 68719476732) + 2) in r2 else if r1 = None \<and> uint 8 = 9 then let r2 = r1 in r2 else if r1 = None \<and> uint 8 = 10 then let r2 = mem s1 11 ((pa AND 68719476732) + 2) in if r2 = None then let r3 = r1 in if r3 = None then mem s1 9 ((pa AND 68719476732) + 2) else r3 else r2 else if r1 = None \<and> uint 8 = 11 then let r2 = mem s1 10 ((pa AND 68719476732) + 2) in if r2 = None then let r3 = r1 in if r3 = None then mem s1 9 ((pa AND 68719476732) + 2) else r3 else r2 else r1) = (let r1 = mem s2 8 ((pa AND 68719476732) + 2) in if r1 = None then let r2 = mem s2 9 ((pa AND 68719476732) + 2) in r2 else if r1 = None \<and> uint 8 = 9 then let r2 = r1 in r2 else if r1 = None \<and> uint 8 = 10 then let r2 = mem s2 11 ((pa AND 68719476732) + 2) in if r2 = None then let r3 = r1 in if r3 = None then mem s2 9 ((pa AND 68719476732) + 2) else r3 else r2 else if r1 = None \<and> uint 8 = 11 then let r2 = mem s2 10 ((pa AND 68719476732) + 2) in if r2 = None then let r3 = r1 in if r3 = None then mem s2 9 ((pa AND 68719476732) + 2) else r3 else r2 else r1)
[PROOF STEP]
apply (simp add: Let_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem_equal s1 s2 pa \<Longrightarrow> (mem s1 8 ((pa AND 68719476732) + 2) = None \<longrightarrow> (mem s2 8 ((pa AND 68719476732) + 2) = None \<longrightarrow> mem s1 9 ((pa AND 68719476732) + 2) = mem s2 9 ((pa AND 68719476732) + 2)) \<and> ((\<exists>y. mem s2 8 ((pa AND 68719476732) + 2) = Some y) \<longrightarrow> mem s1 9 ((pa AND 68719476732) + 2) = mem s2 8 ((pa AND 68719476732) + 2))) \<and> ((\<exists>y. mem s1 8 ((pa AND 68719476732) + 2) = Some y) \<longrightarrow> (mem s2 8 ((pa AND 68719476732) + 2) = None \<longrightarrow> mem s1 8 ((pa AND 68719476732) + 2) = mem s2 9 ((pa AND 68719476732) + 2)) \<and> ((\<exists>y. mem s2 8 ((pa AND 68719476732) + 2) = Some y) \<longrightarrow> mem s1 8 ((pa AND 68719476732) + 2) = mem s2 8 ((pa AND 68719476732) + 2)))
[PROOF STEP]
apply (simp add: mem_equal_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem s1 8 (pa AND 68719476732) = mem s2 8 (pa AND 68719476732) \<and> mem s1 8 ((pa AND 68719476732) + 1) = mem s2 8 ((pa AND 68719476732) + 1) \<and> mem s1 8 ((pa AND 68719476732) + 2) = mem s2 8 ((pa AND 68719476732) + 2) \<and> mem s1 8 ((pa AND 68719476732) + 3) = mem s2 8 ((pa AND 68719476732) + 3) \<and> mem s1 9 (pa AND 68719476732) = mem s2 9 (pa AND 68719476732) \<and> mem s1 9 ((pa AND 68719476732) + 1) = mem s2 9 ((pa AND 68719476732) + 1) \<and> mem s1 9 ((pa AND 68719476732) + 2) = mem s2 9 ((pa AND 68719476732) + 2) \<and> mem s1 9 ((pa AND 68719476732) + 3) = mem s2 9 ((pa AND 68719476732) + 3) \<and> mem s1 10 (pa AND 68719476732) = mem s2 10 (pa AND 68719476732) \<and> mem s1 10 ((pa AND 68719476732) + 1) = mem s2 10 ((pa AND 68719476732) + 1) \<and> mem s1 10 ((pa AND 68719476732) + 2) = mem s2 10 ((pa AND 68719476732) + 2) \<and> mem s1 10 ((pa AND 68719476732) + 3) = mem s2 10 ((pa AND 68719476732) + 3) \<and> mem s1 11 (pa AND 68719476732) = mem s2 11 (pa AND 68719476732) \<and> mem s1 11 ((pa AND 68719476732) + 1) = mem s2 11 ((pa AND 68719476732) + 1) \<and> mem s1 11 ((pa AND 68719476732) + 2) = mem s2 11 ((pa AND 68719476732) + 2) \<and> mem s1 11 ((pa AND 68719476732) + 3) = mem s2 11 ((pa AND 68719476732) + 3) \<Longrightarrow> (\<exists>y. mem s2 8 ((pa AND 68719476732) + 2) = Some y) \<longrightarrow> mem s2 8 ((pa AND 68719476732) + 2) = None \<longrightarrow> None = mem s2 9 ((pa AND 68719476732) + 2)
[PROOF STEP]
by (metis option.distinct(1))


[STATEMENT]
lemma mopup_jump_over2_context[simp]:
  "\<lbrakk>mopup_jump_over2 (2 * n + 6, l, Oc # xs) lm n ires\<rbrakk>
 \<Longrightarrow>  mopup_jump_over2 (2 * n + 6, tl l, hd l # Oc # xs) lm n ires"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mopup_jump_over2 (2 * n + 6, l, Oc # xs) lm n ires \<Longrightarrow> mopup_jump_over2 (2 * n + 6, tl l, hd l # Oc # xs) lm n ires
[PROOF STEP]
apply(simp only: mopup_jump_over2.simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ln rn m1 m2. m1 + m2 = Suc (lm ! n) \<and> Oc # xs \<noteq> [] \<and> (hd (Oc # xs) = Oc \<longrightarrow> l = Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires \<and> Oc # xs = Oc \<up> m2 @ Bk \<up> rn) \<and> (hd (Oc # xs) = Bk \<longrightarrow> l = Bk \<up> ln @ Bk # ires \<and> Oc # xs = Bk # Oc \<up> (m1 + m2) @ Bk \<up> rn) \<Longrightarrow> \<exists>ln rn m1 m2. m1 + m2 = Suc (lm ! n) \<and> hd l # Oc # xs \<noteq> [] \<and> (hd (hd l # Oc # xs) = Oc \<longrightarrow> tl l = Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires \<and> hd l # Oc # xs = Oc \<up> m2 @ Bk \<up> rn) \<and> (hd (hd l # Oc # xs) = Bk \<longrightarrow> tl l = Bk \<up> ln @ Bk # ires \<and> hd l # Oc # xs = Bk # Oc \<up> (m1 + m2) @ Bk \<up> rn)
[PROOF STEP]
apply(erule_tac exE)+
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ln rn m1 m2. m1 + m2 = Suc (lm ! n) \<and> Oc # xs \<noteq> [] \<and> (hd (Oc # xs) = Oc \<longrightarrow> l = Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires \<and> Oc # xs = Oc \<up> m2 @ Bk \<up> rn) \<and> (hd (Oc # xs) = Bk \<longrightarrow> l = Bk \<up> ln @ Bk # ires \<and> Oc # xs = Bk # Oc \<up> (m1 + m2) @ Bk \<up> rn) \<Longrightarrow> \<exists>ln rn m1 m2. m1 + m2 = Suc (lm ! n) \<and> hd l # Oc # xs \<noteq> [] \<and> (hd (hd l # Oc # xs) = Oc \<longrightarrow> tl l = Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires \<and> hd l # Oc # xs = Oc \<up> m2 @ Bk \<up> rn) \<and> (hd (hd l # Oc # xs) = Bk \<longrightarrow> tl l = Bk \<up> ln @ Bk # ires \<and> hd l # Oc # xs = Bk # Oc \<up> (m1 + m2) @ Bk \<up> rn)
[PROOF STEP]
apply(simp, erule conjE, erule_tac conjE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ln rn m1 m2. \<lbrakk>m1 + m2 = Suc (lm ! n); l = Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires; Oc # xs = Oc \<up> m2 @ Bk \<up> rn\<rbrakk> \<Longrightarrow> \<exists>lna rna m1a m2a. m1a + m2a = Suc (lm ! n) \<and> (hd (Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires) = Oc \<longrightarrow> tl (Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires) = Oc \<up> m1a @ Bk \<up> lna @ Bk # Bk # ires \<and> Oc # Oc \<up> m2 @ Bk \<up> rn = Oc \<up> m2a @ Bk \<up> rna) \<and> (hd (Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires) = Bk \<longrightarrow> tl (Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires) = Bk \<up> lna @ Bk # ires \<and> Oc \<up> m2 @ Bk \<up> rn = Oc \<up> (m1a + m2a) @ Bk \<up> rna)
[PROOF STEP]
apply(rename_tac Ln Rn M1 M2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Ln Rn M1 M2. \<lbrakk>M1 + M2 = Suc (lm ! n); l = Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires; Oc # xs = Oc \<up> M2 @ Bk \<up> Rn\<rbrakk> \<Longrightarrow> \<exists>ln rn m1 m2. m1 + m2 = Suc (lm ! n) \<and> (hd (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Oc \<longrightarrow> tl (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires \<and> Oc # Oc \<up> M2 @ Bk \<up> Rn = Oc \<up> m2 @ Bk \<up> rn) \<and> (hd (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Bk \<longrightarrow> tl (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Bk \<up> ln @ Bk # ires \<and> Oc \<up> M2 @ Bk \<up> Rn = Oc \<up> (m1 + m2) @ Bk \<up> rn)
[PROOF STEP]
apply(case_tac M1, simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>Ln Rn M1. \<lbrakk>l = Bk \<up> Ln @ Bk # Bk # ires; xs = Oc \<up> lm ! n @ Bk \<up> Rn; M1 = 0\<rbrakk> \<Longrightarrow> \<exists>ln rn m1 m2. m1 + m2 = Suc (lm ! n) \<and> (hd (Bk \<up> Ln @ Bk # Bk # ires) = Oc \<longrightarrow> tl (Bk \<up> Ln @ Bk # Bk # ires) = Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires \<and> Oc # Oc # Oc \<up> lm ! n @ Bk \<up> Rn = Oc \<up> m2 @ Bk \<up> rn) \<and> (hd (Bk \<up> Ln @ Bk # Bk # ires) = Bk \<longrightarrow> tl (Bk \<up> Ln @ Bk # Bk # ires) = Bk \<up> ln @ Bk # ires \<and> Oc # Oc \<up> lm ! n @ Bk \<up> Rn = Oc \<up> (m1 + m2) @ Bk \<up> rn)
 2. \<And>Ln Rn M1 M2 nat. \<lbrakk>M1 + M2 = Suc (lm ! n); l = Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires; Oc # xs = Oc \<up> M2 @ Bk \<up> Rn; M1 = Suc nat\<rbrakk> \<Longrightarrow> \<exists>ln rn m1 m2. m1 + m2 = Suc (lm ! n) \<and> (hd (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Oc \<longrightarrow> tl (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires \<and> Oc # Oc \<up> M2 @ Bk \<up> Rn = Oc \<up> m2 @ Bk \<up> rn) \<and> (hd (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Bk \<longrightarrow> tl (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Bk \<up> ln @ Bk # ires \<and> Oc \<up> M2 @ Bk \<up> Rn = Oc \<up> (m1 + m2) @ Bk \<up> rn)
[PROOF STEP]
apply(rule_tac x = Ln in exI, rule_tac x = Rn in exI,
      rule_tac x = 0 in exI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>Ln Rn M1. \<lbrakk>l = Bk \<up> Ln @ Bk # Bk # ires; xs = Oc \<up> lm ! n @ Bk \<up> Rn; M1 = 0\<rbrakk> \<Longrightarrow> \<exists>m2. 0 + m2 = Suc (lm ! n) \<and> (hd (Bk \<up> Ln @ Bk # Bk # ires) = Oc \<longrightarrow> tl (Bk \<up> Ln @ Bk # Bk # ires) = Oc \<up> 0 @ Bk \<up> Ln @ Bk # Bk # ires \<and> Oc # Oc # Oc \<up> lm ! n @ Bk \<up> Rn = Oc \<up> m2 @ Bk \<up> Rn) \<and> (hd (Bk \<up> Ln @ Bk # Bk # ires) = Bk \<longrightarrow> tl (Bk \<up> Ln @ Bk # Bk # ires) = Bk \<up> Ln @ Bk # ires \<and> Oc # Oc \<up> lm ! n @ Bk \<up> Rn = Oc \<up> (0 + m2) @ Bk \<up> Rn)
 2. \<And>Ln Rn M1 M2 nat. \<lbrakk>M1 + M2 = Suc (lm ! n); l = Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires; Oc # xs = Oc \<up> M2 @ Bk \<up> Rn; M1 = Suc nat\<rbrakk> \<Longrightarrow> \<exists>ln rn m1 m2. m1 + m2 = Suc (lm ! n) \<and> (hd (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Oc \<longrightarrow> tl (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires \<and> Oc # Oc \<up> M2 @ Bk \<up> Rn = Oc \<up> m2 @ Bk \<up> rn) \<and> (hd (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Bk \<longrightarrow> tl (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Bk \<up> ln @ Bk # ires \<and> Oc \<up> M2 @ Bk \<up> Rn = Oc \<up> (m1 + m2) @ Bk \<up> rn)
[PROOF STEP]
apply(case_tac Ln, simp, simp, simp only: exp_ind[THEN sym], simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Ln Rn M1 M2 nat. \<lbrakk>M1 + M2 = Suc (lm ! n); l = Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires; Oc # xs = Oc \<up> M2 @ Bk \<up> Rn; M1 = Suc nat\<rbrakk> \<Longrightarrow> \<exists>ln rn m1 m2. m1 + m2 = Suc (lm ! n) \<and> (hd (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Oc \<longrightarrow> tl (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Oc \<up> m1 @ Bk \<up> ln @ Bk # Bk # ires \<and> Oc # Oc \<up> M2 @ Bk \<up> Rn = Oc \<up> m2 @ Bk \<up> rn) \<and> (hd (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Bk \<longrightarrow> tl (Oc \<up> M1 @ Bk \<up> Ln @ Bk # Bk # ires) = Bk \<up> ln @ Bk # ires \<and> Oc \<up> M2 @ Bk \<up> Rn = Oc \<up> (m1 + m2) @ Bk \<up> rn)
[PROOF STEP]
apply(rule_tac x = Ln in exI, rule_tac x = Rn in exI,
      rule_tac x = "M1-1" in exI, rule_tac x = "Suc M2" in exI, simp)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done