[STATEMENT]
lemma wcode_on_left_moving_2[simp]:
  "wcode_on_left_moving_2 ires rs (b, Bk # list) \<Longrightarrow>  wcode_on_left_moving_2 ires rs (tl b, hd b # Bk # list)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wcode_on_left_moving_2 ires rs (b, Bk # list) \<Longrightarrow> wcode_on_left_moving_2 ires rs (tl b, hd b # Bk # list)
[PROOF STEP]
apply(simp only: wcode_fourtimes_invs)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>ml mr rn. b = Bk \<up> ml @ Oc # Bk # Oc # ires \<and> Bk # list = Bk \<up> mr @ Oc \<up> Suc rs @ Bk \<up> rn \<and> Suc 0 < ml + mr \<and> 0 < mr) \<or> (\<exists>ln rn. b = Bk # Oc # ires \<and> Bk # list = Oc # Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn) \<Longrightarrow> (\<exists>ml mr rn. tl b = Bk \<up> ml @ Oc # Bk # Oc # ires \<and> hd b # Bk # list = Bk \<up> mr @ Oc \<up> Suc rs @ Bk \<up> rn \<and> Suc 0 < ml + mr \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Oc # ires \<and> hd b # Bk # list = Oc # Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn)
[PROOF STEP]
apply(erule_tac disjE)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<exists>ml mr rn. b = Bk \<up> ml @ Oc # Bk # Oc # ires \<and> Bk # list = Bk \<up> mr @ Oc \<up> Suc rs @ Bk \<up> rn \<and> Suc 0 < ml + mr \<and> 0 < mr \<Longrightarrow> (\<exists>ml mr rn. tl b = Bk \<up> ml @ Oc # Bk # Oc # ires \<and> hd b # Bk # list = Bk \<up> mr @ Oc \<up> Suc rs @ Bk \<up> rn \<and> Suc 0 < ml + mr \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Oc # ires \<and> hd b # Bk # list = Oc # Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn)
 2. \<exists>ln rn. b = Bk # Oc # ires \<and> Bk # list = Oc # Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn \<Longrightarrow> (\<exists>ml mr rn. tl b = Bk \<up> ml @ Oc # Bk # Oc # ires \<and> hd b # Bk # list = Bk \<up> mr @ Oc \<up> Suc rs @ Bk \<up> rn \<and> Suc 0 < ml + mr \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Oc # ires \<and> hd b # Bk # list = Oc # Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn)
[PROOF STEP]
apply(erule_tac exE)+
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ml mr rn. b = Bk \<up> ml @ Oc # Bk # Oc # ires \<and> Bk # list = Bk \<up> mr @ Oc \<up> Suc rs @ Bk \<up> rn \<and> Suc 0 < ml + mr \<and> 0 < mr \<Longrightarrow> (\<exists>ml mr rn. tl b = Bk \<up> ml @ Oc # Bk # Oc # ires \<and> hd b # Bk # list = Bk \<up> mr @ Oc \<up> Suc rs @ Bk \<up> rn \<and> Suc 0 < ml + mr \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Oc # ires \<and> hd b # Bk # list = Oc # Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn)
 2. \<exists>ln rn. b = Bk # Oc # ires \<and> Bk # list = Oc # Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn \<Longrightarrow> (\<exists>ml mr rn. tl b = Bk \<up> ml @ Oc # Bk # Oc # ires \<and> hd b # Bk # list = Bk \<up> mr @ Oc \<up> Suc rs @ Bk \<up> rn \<and> Suc 0 < ml + mr \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Oc # ires \<and> hd b # Bk # list = Oc # Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn)
[PROOF STEP]
apply(simp add: gr1_conv_Suc exp_ind replicate_app_Cons_same hd_repeat_cases')
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ml mr rn. b = Bk \<up> ml @ Oc # Bk # Oc # ires \<and> Bk # list = Bk \<up> mr @ Oc # Oc \<up> rs @ Bk \<up> rn \<and> (\<exists>nat. ml + mr = Suc (Suc nat)) \<and> 0 < mr \<Longrightarrow> (ml = 0 \<longrightarrow> (\<exists>ln rna. Bk \<up> mr @ Oc # Oc \<up> rs @ Bk \<up> rn = Bk # Bk # Bk \<up> ln @ Oc # Oc \<up> rs @ Bk \<up> rna)) \<and> (0 < ml \<longrightarrow> (\<exists>mra. (\<exists>rna. Bk # Bk \<up> mr @ Oc # Oc \<up> rs @ Bk \<up> rn = Bk \<up> mra @ Oc # Oc \<up> rs @ Bk \<up> rna) \<and> (\<exists>nat. ml + mra - Suc 0 = Suc (Suc nat)) \<and> 0 < mra))
 2. \<exists>ln rn. b = Bk # Oc # ires \<and> Bk # list = Oc # Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn \<Longrightarrow> (\<exists>ml mr rn. tl b = Bk \<up> ml @ Oc # Bk # Oc # ires \<and> hd b # Bk # list = Bk \<up> mr @ Oc \<up> Suc rs @ Bk \<up> rn \<and> Suc 0 < ml + mr \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Oc # ires \<and> hd b # Bk # list = Oc # Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn)
[PROOF STEP]
apply (auto simp add: gr0_conv_Suc[symmetric] replicate_app_Cons_same hd_repeat_cases')
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>rn nat. \<lbrakk>b = Oc # Bk # Oc # ires; list = Bk # Bk \<up> nat @ Oc # Oc \<up> rs @ Bk \<up> rn\<rbrakk> \<Longrightarrow> \<exists>ln rna. Bk \<up> nat @ Oc # Oc \<up> rs @ Bk \<up> rn = Bk \<up> ln @ Oc # Oc \<up> rs @ Bk \<up> rna
 2. \<And>ml mr rn nat. \<lbrakk>b = Bk \<up> ml @ Oc # Bk # Oc # ires; Bk # list = Bk \<up> mr @ Oc # Oc \<up> rs @ Bk \<up> rn; 0 < mr; ml + mr = Suc (Suc nat); 0 < ml\<rbrakk> \<Longrightarrow> \<exists>mra. (\<exists>rna. Bk # Bk \<up> mr @ Oc # Oc \<up> rs @ Bk \<up> rn = Bk \<up> mra @ Oc # Oc \<up> rs @ Bk \<up> rna) \<and> (\<exists>nat. ml + mra - Suc 0 = Suc (Suc nat)) \<and> 0 < mra
[PROOF STEP]
by force+


[STATEMENT]
lemma no_write_to_read_only_memory_read_only_reads_eq:
  "\<And>\<S> \<S>'.
  \<lbrakk>no_write_to_read_only_memory \<S> sb;
   \<forall>a \<in> outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>
  \<rbrakk>
  \<Longrightarrow> no_write_to_read_only_memory \<S>' sb"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<S> \<S>'. \<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb
[PROOF STEP]
proof (induct sb)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<S> \<S>'. \<lbrakk>no_write_to_read_only_memory \<S> []; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b []. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' []
 2. \<And>a sb \<S> \<S>'. \<lbrakk>\<And>\<S> \<S>'. \<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb; no_write_to_read_only_memory \<S> (a # sb); \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (a # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' (a # sb)
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory \<S> []
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b []. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>

goal (2 subgoals):
 1. \<And>\<S> \<S>'. \<lbrakk>no_write_to_read_only_memory \<S> []; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b []. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' []
 2. \<And>a sb \<S> \<S>'. \<lbrakk>\<And>\<S> \<S>'. \<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb; no_write_to_read_only_memory \<S> (a # sb); \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (a # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' (a # sb)
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
no_write_to_read_only_memory \<S> []
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b []. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>

goal (1 subgoal):
 1. no_write_to_read_only_memory \<S>' []
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory \<S>' []

goal (1 subgoal):
 1. \<And>a sb \<S> \<S>'. \<lbrakk>\<And>\<S> \<S>'. \<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb; no_write_to_read_only_memory \<S> (a # sb); \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (a # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' (a # sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a sb \<S> \<S>'. \<lbrakk>\<And>\<S> \<S>'. \<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb; no_write_to_read_only_memory \<S> (a # sb); \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (a # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' (a # sb)
[PROOF STEP]
case (Cons x sb)
[PROOF STATE]
proof (state)
this:
\<lbrakk>no_write_to_read_only_memory ?\<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only ?\<S>' \<longrightarrow> a \<in> read_only ?\<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory ?\<S>' sb
no_write_to_read_only_memory \<S> (x # sb)
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (x # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>

goal (1 subgoal):
 1. \<And>a sb \<S> \<S>'. \<lbrakk>\<And>\<S> \<S>'. \<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb; no_write_to_read_only_memory \<S> (a # sb); \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (a # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' (a # sb)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
proof (cases x)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>x11 x12 x13 x14 x15 x16 x17 x18. x = Write\<^sub>s\<^sub>b x11 x12 x13 x14 x15 x16 x17 x18 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 3. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 4. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
case (Write\<^sub>s\<^sub>b volatile a sop v A L R W)
[PROOF STATE]
proof (state)
this:
x = Write\<^sub>s\<^sub>b volatile a sop v A L R W

goal (4 subgoals):
 1. \<And>x11 x12 x13 x14 x15 x16 x17 x18. x = Write\<^sub>s\<^sub>b x11 x12 x13 x14 x15 x16 x17 x18 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 3. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 4. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
proof (cases volatile)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<not> volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
volatile

goal (2 subgoals):
 1. volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<not> volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
note volatile=this
[PROOF STATE]
proof (state)
this:
volatile

goal (2 subgoals):
 1. volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<not> volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
from Cons.prems
[PROOF STATE]
proof (chain)
picking this:
no_write_to_read_only_memory \<S> (x # sb)
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (x # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>
[PROOF STEP]
obtain
	nvo': "no_write_to_read_only_memory (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) sb" and
	ro': "\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>" and
	not_ro: "a \<notin> read_only \<S>'"
[PROOF STATE]
proof (prove)
using this:
no_write_to_read_only_memory \<S> (x # sb)
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (x # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>

goal (1 subgoal):
 1. (\<lbrakk>no_write_to_read_only_memory (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>; a \<notin> read_only \<S>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (auto simp add: Write\<^sub>s\<^sub>b volatile)
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) sb
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>
a \<notin> read_only \<S>'

goal (2 subgoals):
 1. volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<not> volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
from ro'
[PROOF STATE]
proof (chain)
picking this:
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>
[PROOF STEP]
have ro'':"\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb.
        a \<in> read_only (\<S>' \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) \<longrightarrow> a \<in> read_only (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)"
[PROOF STATE]
proof (prove)
using this:
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>

goal (1 subgoal):
 1. \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only (\<S>' \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) \<longrightarrow> a \<in> read_only (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
by (auto simp add: in_read_only_convs)
[PROOF STATE]
proof (state)
this:
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only (\<S>' \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) \<longrightarrow> a \<in> read_only (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)

goal (2 subgoals):
 1. volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<not> volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
from Cons.hyps [OF nvo' ro''] not_ro
[PROOF STATE]
proof (chain)
picking this:
no_write_to_read_only_memory (\<S>' \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) sb
a \<notin> read_only \<S>'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
no_write_to_read_only_memory (\<S>' \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) sb
a \<notin> read_only \<S>'

goal (1 subgoal):
 1. no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
by (clarsimp simp add: Write\<^sub>s\<^sub>b volatile)
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory \<S>' (x # sb)

goal (1 subgoal):
 1. \<not> volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> volatile

goal (1 subgoal):
 1. \<not> volatile \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
with Cons.hyps [of \<S> \<S>'] Cons.prems
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb
no_write_to_read_only_memory \<S> (x # sb)
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (x # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>
\<not> volatile
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb
no_write_to_read_only_memory \<S> (x # sb)
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (x # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>
\<not> volatile

goal (1 subgoal):
 1. no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
by (auto simp add: Write\<^sub>s\<^sub>b)
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory \<S>' (x # sb)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory \<S>' (x # sb)

goal (3 subgoals):
 1. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 3. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 3. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
case (Read\<^sub>s\<^sub>b volatile a t v)
[PROOF STATE]
proof (state)
this:
x = Read\<^sub>s\<^sub>b volatile a t v

goal (3 subgoals):
 1. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 3. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
with Cons.hyps [of \<S> \<S>'] Cons.prems
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb
no_write_to_read_only_memory \<S> (x # sb)
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (x # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>
x = Read\<^sub>s\<^sub>b volatile a t v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb
no_write_to_read_only_memory \<S> (x # sb)
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (x # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>
x = Read\<^sub>s\<^sub>b volatile a t v

goal (1 subgoal):
 1. no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
by (auto simp add: Read\<^sub>s\<^sub>b)
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory \<S>' (x # sb)

goal (2 subgoals):
 1. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
case Prog\<^sub>s\<^sub>b
[PROOF STATE]
proof (state)
this:
x = Prog\<^sub>s\<^sub>b x31_ x32_ x33_

goal (2 subgoals):
 1. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
 2. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
with Cons.hyps [of \<S> \<S>'] Cons.prems
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb
no_write_to_read_only_memory \<S> (x # sb)
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (x # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>
x = Prog\<^sub>s\<^sub>b x31_ x32_ x33_
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>no_write_to_read_only_memory \<S> sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory \<S>' sb
no_write_to_read_only_memory \<S> (x # sb)
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (x # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>
x = Prog\<^sub>s\<^sub>b x31_ x32_ x33_

goal (1 subgoal):
 1. no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
by (auto)
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory \<S>' (x # sb)

goal (1 subgoal):
 1. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
case (Ghost\<^sub>s\<^sub>b A L R W)
[PROOF STATE]
proof (state)
this:
x = Ghost\<^sub>s\<^sub>b A L R W

goal (1 subgoal):
 1. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
from Cons.hyps [of "(\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)" "\<S>' \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L"] Cons.prems
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>no_write_to_read_only_memory (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only (\<S>' \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) \<longrightarrow> a \<in> read_only (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory (\<S>' \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) sb
no_write_to_read_only_memory \<S> (x # sb)
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (x # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>no_write_to_read_only_memory (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) sb; \<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b sb. a \<in> read_only (\<S>' \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) \<longrightarrow> a \<in> read_only (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)\<rbrakk> \<Longrightarrow> no_write_to_read_only_memory (\<S>' \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) sb
no_write_to_read_only_memory \<S> (x # sb)
\<forall>a\<in>outstanding_refs is_Write\<^sub>s\<^sub>b (x # sb). a \<in> read_only \<S>' \<longrightarrow> a \<in> read_only \<S>

goal (1 subgoal):
 1. no_write_to_read_only_memory \<S>' (x # sb)
[PROOF STEP]
by (auto simp add: Ghost\<^sub>s\<^sub>b in_read_only_convs)
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory \<S>' (x # sb)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory \<S>' (x # sb)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "(\<exists>x. P x) \<longrightarrow> (\<exists>!x. P x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x. P x) \<longrightarrow> (\<exists>!x. P x)
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x. P x) \<longrightarrow> (\<exists>!x. P x)
[PROOF STEP]
oops


[STATEMENT]
lemma delete_shadow_root_type_wf_preserved [simp]:
  assumes "h \<turnstile> delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M shadow_root_ptr \<rightarrow>\<^sub>h h'"
  assumes "type_wf h"
  shows "type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ShadowRootClass.type_wf h'
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
h \<turnstile> delete_M shadow_root_ptr \<rightarrow>\<^sub>h h'
ShadowRootClass.type_wf h

goal (1 subgoal):
 1. ShadowRootClass.type_wf h'
[PROOF STEP]
using type_wf_drop
[PROOF STATE]
proof (prove)
using this:
h \<turnstile> delete_M shadow_root_ptr \<rightarrow>\<^sub>h h'
ShadowRootClass.type_wf h
ShadowRootClass.type_wf ?h \<Longrightarrow> ShadowRootClass.type_wf (Heap (fmdrop ?ptr (the_heap ?h)))

goal (1 subgoal):
 1. ShadowRootClass.type_wf h'
[PROOF STEP]
by(auto simp add: delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M_def delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def split: if_splits)


[STATEMENT]
lemma get_child_nodes_delete_shadow_root:
  "ptr' \<noteq> cast shadow_root_ptr \<Longrightarrow> h \<turnstile> delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M shadow_root_ptr \<rightarrow>\<^sub>h h' \<Longrightarrow>
r \<in> get_child_nodes_locs ptr' \<Longrightarrow> r h h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ptr' \<noteq> cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root_ptr; h \<turnstile> delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M shadow_root_ptr \<rightarrow>\<^sub>h h'; r \<in> get_child_nodes_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
by(auto simp add: get_child_nodes_locs_def CD.get_child_nodes_locs_def delete_shadow_root_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
      delete_shadow_root_get_M\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t delete_shadow_root_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t delete_shadow_root_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
      split: if_splits  intro: is_shadow_root_ptr_kind_obtains
      intro: is_shadow_root_ptr_kind_obtains delete_shadow_root_get_M\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t delete_shadow_root_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
      simp add: shadow_root_ptr_casts_commute3 delete_shadow_root_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
      intro!: delete_shadow_root_get_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t dest: document_ptr_casts_commute3
      split: option.splits)


[STATEMENT]
lemma rreq_rrep_sn_any_step_invariant:
  "paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(_, a, _). anycast rreq_rrep_sn a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(uu_, a, uu_). anycast rreq_rrep_sn a)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(uu_, a, uu_). anycast rreq_rrep_sn a)
[PROOF STEP]
have sqnf_kno: "paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l).
                                      (l \<in> {PRreq-:16..PRreq-:18} \<longrightarrow> sqnf (rt \<xi>) (dip \<xi>) = kno))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l). l \<in> {PRreq-:16..PRreq-:18} \<longrightarrow> sqnf (rt \<xi>) (dip \<xi>) = kno)
[PROOF STEP]
by (inv_cterms inv add: onl_invariant_sterms_TT [OF aodv_wf addpreRT_welldefined])
[PROOF STATE]
proof (state)
this:
paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l). l \<in> {PRreq-:16..PRreq-:18} \<longrightarrow> sqnf (rt \<xi>) (dip \<xi>) = kno)

goal (1 subgoal):
 1. paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(uu_, a, uu_). anycast rreq_rrep_sn a)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(uu_, a, uu_). anycast rreq_rrep_sn a)
[PROOF STEP]
by (inv_cterms inv add: onl_invariant_sterms_TT [OF aodv_wf addpreRT_welldefined]
                              onl_invariant_sterms [OF aodv_wf sequence_number_one_or_bigger
                                                               [THEN invariant_restrict_inD]]
                              onl_invariant_sterms [OF aodv_wf kD_unk_or_atleast_one]
                              onl_invariant_sterms_TT [OF aodv_wf sqnf_kno]
                              onl_invariant_sterms [OF aodv_wf osn_rreq]
                              onl_invariant_sterms [OF aodv_wf dsn_rrep])
         (auto simp: proj2_eq_sqn)
[PROOF STATE]
proof (state)
this:
paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(uu_, a, uu_). anycast rreq_rrep_sn a)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "undefined x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. undefined x
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. undefined x
[PROOF STEP]
oops


[STATEMENT]
lemma Outpts_B_Card_7:
      "\<lbrakk> Outpts C B \<lbrace>Nonce Nb, Key K,
                      Crypt (pairK(A,B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>,
                      Cert2\<rbrace> \<in> set evs;
         evs \<in> sr \<rbrakk>
     \<Longrightarrow> legalUse(C) \<and> C = (Card B) \<and>
         Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set evs; evs \<in> sr\<rbrakk> \<Longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set evs
[PROOF STEP]
apply (erule rev_mp, erule sr.induct)
[PROOF STATE]
proof (prove)
goal (20 subgoals):
 1. Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set [] \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set []
 2. \<And>evsF X Ba Aa. \<lbrakk>evsF \<in> sr; Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set evsF \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set evsF; X \<in> synth (analz (knows Spy evsF)); illegalUse (Card Ba)\<rbrakk> \<Longrightarrow> Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set (Says Spy Aa X # Inputs Spy (Card Ba) X # evsF) \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set (Says Spy Aa X # Inputs Spy (Card Ba) X # evsF)
 3. \<And>evsFo Nba Aa Ba. \<lbrakk>evsFo \<in> sr; Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set evsFo \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set evsFo; Nonce Nba \<in> analz (knows Spy evsFo); Key (pairK (Aa, Ba)) \<in> knows Spy evsFo\<rbrakk> \<Longrightarrow> Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set (Notes Spy (Key (sesK (Nba, pairK (Aa, Ba)))) # evsFo) \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set (Notes Spy (Key (sesK (Nba, pairK (Aa, Ba)))) # evsFo)
 4. \<And>evsR Aa Ba X. \<lbrakk>evsR \<in> sr; Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set evsR \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set evsR; Says Aa Ba X \<in> set evsR\<rbrakk> \<Longrightarrow> Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set (Gets Ba X # evsR) \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set (Gets Ba X # evsR)
 5. \<And>evs1 Aa Ba. \<lbrakk>evs1 \<in> sr; Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set evs1 \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set evs1; Aa \<noteq> Server\<rbrakk> \<Longrightarrow> Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1) \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1)
 6. \<And>evs2 Aa Ba. \<lbrakk>evs2 \<in> sr; Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set evs2 \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set evs2; Gets Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set (Says Server Aa \<lbrace>Nonce (Pairkey (Aa, Ba)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, Ba)), Agent Ba\<rbrace>\<rbrace> # evs2) \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set (Says Server Aa \<lbrace>Nonce (Pairkey (Aa, Ba)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, Ba)), Agent Ba\<rbrace>\<rbrace> # evs2)
 7. \<And>evs3 Aa Ba Pk Certificate. \<lbrakk>evs3 \<in> sr; Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set evs3 \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set evs3; legalUse Card Aa; Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs3; Gets Aa \<lbrace>Nonce Pk, Certificate\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set (Inputs Aa (Card Aa) (Agent Aa) # evs3) \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set (Inputs Aa (Card Aa) (Agent Aa) # evs3)
 8. \<And>evs4 Aa Naa. \<lbrakk>evs4 \<in> sr; Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set evs4 \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set evs4; Aa \<noteq> Server; Nonce Naa \<notin> used evs4; legalUse Card Aa; Inputs Aa (Card Aa) (Agent Aa) \<in> set evs4\<rbrakk> \<Longrightarrow> Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set (Outpts (Card Aa) Aa \<lbrace>Nonce Naa, Crypt (crdK (Card Aa)) (Nonce Naa)\<rbrace> # evs4) \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set (Outpts (Card Aa) Aa \<lbrace>Nonce Naa, Crypt (crdK (Card Aa)) (Nonce Naa)\<rbrace> # evs4)
 9. \<And>evs4F Naa Aa. \<lbrakk>evs4F \<in> sr; Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set evs4F \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set evs4F; Nonce Naa \<notin> used evs4F; illegalUse (Card Aa); Inputs Spy (Card Aa) (Agent Aa) \<in> set evs4F\<rbrakk> \<Longrightarrow> Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set (Outpts (Card Aa) Spy \<lbrace>Nonce Naa, Crypt (crdK (Card Aa)) (Nonce Naa)\<rbrace> # evs4F) \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set (Outpts (Card Aa) Spy \<lbrace>Nonce Naa, Crypt (crdK (Card Aa)) (Nonce Naa)\<rbrace> # evs4F)
 10. \<And>evs5 Aa Naa Certificate Ba. \<lbrakk>evs5 \<in> sr; Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set evs5 \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set evs5; Outpts (Card Aa) Aa \<lbrace>Nonce Naa, Certificate\<rbrace> \<in> set evs5; \<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>\<rbrakk> \<Longrightarrow> Outpts C B \<lbrace>Nonce Nb, Key K, Crypt (pairK (A, B)) \<lbrace>Nonce Na, Nonce Nb\<rbrace>, Cert2\<rbrace> \<in> set (Says Aa Ba \<lbrace>Agent Aa, Nonce Naa\<rbrace> # evs5) \<longrightarrow> legalUse C \<and> C = Card B \<and> Inputs B (Card B) \<lbrace>Agent A, Nonce Na\<rbrace> \<in> set (Says Aa Ba \<lbrace>Agent Aa, Nonce Naa\<rbrace> # evs5)
A total of 20 subgoals...
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma lossless_intercept_upf [simp]: "lossless_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (intercept_upf k b LD x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lossless_gpv (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) (intercept_upf k b LD x)
[PROOF STEP]
by(cases x)(simp_all add: intercept_upf_def)


[STATEMENT]
lemma
assumes isTrue: "isTrue c"
shows
"([((Cond (Const c) (Assign True (Tmp ({},\<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip,t) ,[],\<theta>,(),\<D>,\<O>,\<R>)],m,\<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>*
 ([((Skip,t),[],\<theta>,(),True,\<O> \<union> A - R,Map.empty)],m(a := c),\<S>  \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ([((Cond (Const c) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply (rule converse_rtranclp_into_rtranclp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. ([((Cond (Const c) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p ?b
 2. ?b \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply  (rule direct.Program [where i=0])
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. 0 < length [((Cond (Const c) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)]
 2. [((Cond (Const c) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)] ! 0 = (?p3, ?is3, ?\<theta>3, ?sb3, ?\<D>3, ?\<O>3, ?\<R>3)
 3. ?\<theta>3\<turnstile> ?p3 \<rightarrow>\<^sub>s (?p'3, ?is'3)
 4. ([((Cond (Const c) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)][0 := (?p'3, ?is3 @ ?is'3, ?\<theta>3, (), ?\<D>3, ?\<O>3, ?\<R>3)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply    simp
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. [((Cond (Const c) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)] ! 0 = (?p3, ?is3, ?\<theta>3, ?sb3, ?\<D>3, ?\<O>3, ?\<R>3)
 2. ?\<theta>3\<turnstile> ?p3 \<rightarrow>\<^sub>s (?p'3, ?is'3)
 3. ([((Cond (Const c) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)][0 := (?p'3, ?is3 @ ?is'3, ?\<theta>3, (), ?\<D>3, ?\<O>3, ?\<R>3)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply   simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<theta>\<turnstile> (Cond (Const c) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t) \<rightarrow>\<^sub>s (?p'3, ?is'3)
 2. ([((Cond (Const c) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)][0 := (?p'3, [] @ ?is'3, \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply  (rule Cond)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<forall>sop. Const c \<noteq> Tmp sop
 2. ([((Cond (Const c) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)][0 := ((Cond (Tmp (eval_expr t (Const c))) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t + used_tmps (Const c)), [] @ issue_expr t (Const c), \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply  simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ([((Cond (Const c) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)][0 := ((Cond (Tmp (eval_expr t (Const c))) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t + used_tmps (Const c)), [] @ issue_expr t (Const c), \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ([((Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply (rule converse_rtranclp_into_rtranclp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. ([((Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p ?b20
 2. ?b20 \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply  (rule direct.Program [where i=0])
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. 0 < length [((Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)]
 2. [((Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)] ! 0 = (?p23, ?is23, ?\<theta>23, ?sb23, ?\<D>23, ?\<O>23, ?\<R>23)
 3. ?\<theta>23\<turnstile> ?p23 \<rightarrow>\<^sub>s (?p'23, ?is'23)
 4. ([((Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)][0 := (?p'23, ?is23 @ ?is'23, ?\<theta>23, (), ?\<D>23, ?\<O>23, ?\<R>23)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply    simp
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. [((Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)] ! 0 = (?p23, ?is23, ?\<theta>23, ?sb23, ?\<D>23, ?\<O>23, ?\<R>23)
 2. ?\<theta>23\<turnstile> ?p23 \<rightarrow>\<^sub>s (?p'23, ?is'23)
 3. ([((Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)][0 := (?p'23, ?is23 @ ?is'23, ?\<theta>23, (), ?\<D>23, ?\<O>23, ?\<R>23)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply   simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<theta>\<turnstile> (Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t) \<rightarrow>\<^sub>s (?p'23, ?is'23)
 2. ([((Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)][0 := (?p'23, [] @ ?is'23, \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply  (rule CondTrue)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. {} \<subseteq> dom \<theta>
 2. isTrue c
 3. ([((Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)][0 := ((Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W), t), [] @ [], \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply   simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. isTrue c
 2. ([((Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)][0 := ((Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W), t), [] @ [], \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply  (simp add: isTrue)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ([((Cond (Tmp ({}, \<lambda>\<theta>. c)) (Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W)) Skip, t), [], \<theta>, (), \<D>, \<O>, \<R>)][0 := ((Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W), t), [] @ [], \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ([((Assign True (Tmp ({}, \<lambda>\<theta>. a)) (Const c) (\<lambda>\<theta>. A) (\<lambda>\<theta>. L) (\<lambda>\<theta>. R) (\<lambda>\<theta>. W), t), [], \<theta>, (), \<D>, \<O>, \<R>)], m, \<S>) \<Rightarrow>\<^sub>d\<^sub>p\<^sup>* ([((Skip, t), [], \<theta>, (), True, \<O> \<union> A - R, Map.empty)], m(a := c), \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
[PROOF STEP]
apply (rule Assign_Const_ex)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done