[STATEMENT]
lemma "(Q::nat \<Rightarrow> bool) \<noteq> bot \<Longrightarrow> (Q::nat \<Rightarrow> bool) (Eps Q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Q \<noteq> bot \<Longrightarrow> Q (Eps Q)
[PROOF STEP]
nitpick [expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Q \<noteq> bot \<Longrightarrow> Q (Eps Q)
[PROOF STEP]
sorry


[STATEMENT]
lemma fst_gb_schema_dummy_components:
  assumes "struct_spec sel ap ab compl" and "set ps \<subseteq> (set bs) \<times> (set gs \<union> set bs)"
  shows "component_of_term ` Keys (fst ` set (fst (gb_schema_dummy data D bs ps))) =
          component_of_term ` Keys (args_to_set (gs, bs, ps))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. component_of_term ` Keys (fst ` set (fst (gb_schema_dummy data D bs ps))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
struct_spec sel ap ab compl
set ps \<subseteq> set bs \<times> (set gs \<union> set bs)

goal (1 subgoal):
 1. component_of_term ` Keys (fst ` set (fst (gb_schema_dummy data D bs ps))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
proof (induct rule: gb_schema_dummy_induct)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>bs data D. set [] \<subseteq> set bs \<times> (set gs \<union> set bs) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gs @ bs, D))) = component_of_term ` Keys (args_to_set (gs, bs, []))
 2. \<And>bs ps sps data D. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); fst data \<le> count_const_lt_components (fst (compl gs bs (ps -- sps) sps (snd data))); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (full_gb (gs @ bs), D))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
 3. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
case (base bs data D)
[PROOF STATE]
proof (state)
this:
set [] \<subseteq> set bs \<times> (set gs \<union> set bs)

goal (3 subgoals):
 1. \<And>bs data D. set [] \<subseteq> set bs \<times> (set gs \<union> set bs) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gs @ bs, D))) = component_of_term ` Keys (args_to_set (gs, bs, []))
 2. \<And>bs ps sps data D. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); fst data \<le> count_const_lt_components (fst (compl gs bs (ps -- sps) sps (snd data))); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (full_gb (gs @ bs), D))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
 3. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. component_of_term ` Keys (fst ` set (fst (gs @ bs, D))) = component_of_term ` Keys (args_to_set (gs, bs, []))
[PROOF STEP]
by (simp add: args_to_set_def)
[PROOF STATE]
proof (state)
this:
component_of_term ` Keys (fst ` set (fst (gs @ bs, D))) = component_of_term ` Keys (args_to_set (gs, bs, []))

goal (2 subgoals):
 1. \<And>bs ps sps data D. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); fst data \<le> count_const_lt_components (fst (compl gs bs (ps -- sps) sps (snd data))); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (full_gb (gs @ bs), D))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
 2. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>bs ps sps data D. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); fst data \<le> count_const_lt_components (fst (compl gs bs (ps -- sps) sps (snd data))); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (full_gb (gs @ bs), D))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
 2. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
case (rec1 bs ps sps data D)
[PROOF STATE]
proof (state)
this:
ps \<noteq> []
sps = sel gs bs ps (snd data)
fst data \<le> count_const_lt_components (fst (compl gs bs (ps -- sps) sps (snd data)))
set ps \<subseteq> set bs \<times> (set gs \<union> set bs)

goal (2 subgoals):
 1. \<And>bs ps sps data D. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); fst data \<le> count_const_lt_components (fst (compl gs bs (ps -- sps) sps (snd data))); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (full_gb (gs @ bs), D))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
 2. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
have "component_of_term ` Keys (fst ` set (full_gb (gs @ bs))) =
        component_of_term ` Keys (fst ` set (gs @ bs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. component_of_term ` Keys (fst ` set (full_gb (gs @ bs))) = component_of_term ` Keys (fst ` set (gs @ bs))
[PROOF STEP]
by (fact components_full_gb)
[PROOF STATE]
proof (state)
this:
component_of_term ` Keys (fst ` set (full_gb (gs @ bs))) = component_of_term ` Keys (fst ` set (gs @ bs))

goal (2 subgoals):
 1. \<And>bs ps sps data D. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); fst data \<le> count_const_lt_components (fst (compl gs bs (ps -- sps) sps (snd data))); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (full_gb (gs @ bs), D))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
 2. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
component_of_term ` Keys (fst ` set (full_gb (gs @ bs))) = component_of_term ` Keys (fst ` set (gs @ bs))

goal (2 subgoals):
 1. \<And>bs ps sps data D. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); fst data \<le> count_const_lt_components (fst (compl gs bs (ps -- sps) sps (snd data))); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (full_gb (gs @ bs), D))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
 2. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
have "... = component_of_term ` Keys (args_to_set (gs, bs, ps))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. component_of_term ` Keys (fst ` set (gs @ bs)) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
by (simp add: args_to_set_subset_Times[OF rec1.prems] image_Un)
[PROOF STATE]
proof (state)
this:
component_of_term ` Keys (fst ` set (gs @ bs)) = component_of_term ` Keys (args_to_set (gs, bs, ps))

goal (2 subgoals):
 1. \<And>bs ps sps data D. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); fst data \<le> count_const_lt_components (fst (compl gs bs (ps -- sps) sps (snd data))); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (full_gb (gs @ bs), D))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
 2. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
component_of_term ` Keys (fst ` set (full_gb (gs @ bs))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
component_of_term ` Keys (fst ` set (full_gb (gs @ bs))) = component_of_term ` Keys (args_to_set (gs, bs, ps))

goal (1 subgoal):
 1. component_of_term ` Keys (fst ` set (fst (full_gb (gs @ bs), D))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
component_of_term ` Keys (fst ` set (fst (full_gb (gs @ bs), D))) = component_of_term ` Keys (args_to_set (gs, bs, ps))

goal (1 subgoal):
 1. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
case (rec2 bs ps sps aux hs rc data data' D D')
[PROOF STATE]
proof (state)
this:
ps \<noteq> []
sps = sel gs bs ps (snd data)
aux = compl gs bs (ps -- sps) sps (snd data)
(hs, data') = add_indices aux (snd data)
rc = fst data - count_const_lt_components (fst aux)
0 < rc
D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data'))
set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data'))
set ps \<subseteq> set bs \<times> (set gs \<union> set bs)

goal (1 subgoal):
 1. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
from assms(1)
[PROOF STATE]
proof (chain)
picking this:
struct_spec sel ap ab compl
[PROOF STEP]
have ap: "ap_spec ap" and ab: "ab_spec ab"
[PROOF STATE]
proof (prove)
using this:
struct_spec sel ap ab compl

goal (1 subgoal):
 1. ap_spec ap &&& ab_spec ab
[PROOF STEP]
by (rule struct_specD)+
[PROOF STATE]
proof (state)
this:
ap_spec ap
ab_spec ab

goal (1 subgoal):
 1. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
from this rec2.prems
[PROOF STATE]
proof (chain)
picking this:
ap_spec ap
ab_spec ab
set ps \<subseteq> set bs \<times> (set gs \<union> set bs)
[PROOF STEP]
have sub: "set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data'))"
[PROOF STATE]
proof (prove)
using this:
ap_spec ap
ab_spec ab
set ps \<subseteq> set bs \<times> (set gs \<union> set bs)

goal (1 subgoal):
 1. set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data'))
[PROOF STEP]
by (rule subset_Times_ap)
[PROOF STATE]
proof (state)
this:
set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data'))

goal (1 subgoal):
 1. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
from rec2(4)
[PROOF STATE]
proof (chain)
picking this:
(hs, data') = add_indices aux (snd data)
[PROOF STEP]
have hs: "hs = fst (add_indices (compl gs bs (ps -- sps) sps (snd data)) (snd data))"
[PROOF STATE]
proof (prove)
using this:
(hs, data') = add_indices aux (snd data)

goal (1 subgoal):
 1. hs = fst (add_indices (compl gs bs (ps -- sps) sps (snd data)) (snd data))
[PROOF STEP]
unfolding rec2(3)
[PROOF STATE]
proof (prove)
using this:
(hs, data') = add_indices (compl gs bs (ps -- sps) sps (snd data)) (snd data)

goal (1 subgoal):
 1. hs = fst (add_indices (compl gs bs (ps -- sps) sps (snd data)) (snd data))
[PROOF STEP]
by (metis fstI)
[PROOF STATE]
proof (state)
this:
hs = fst (add_indices (compl gs bs (ps -- sps) sps (snd data)) (snd data))

goal (1 subgoal):
 1. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
have "component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')) =
        component_of_term ` Keys (args_to_set (gs, bs, ps))" (is "?l = ?r")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')) \<subseteq> component_of_term ` Keys (args_to_set (gs, bs, ps))
 2. component_of_term ` Keys (args_to_set (gs, bs, ps)) \<subseteq> component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data'))
[PROOF STEP]
from assms(1) rec2(1, 2) hs
[PROOF STATE]
proof (chain)
picking this:
struct_spec sel ap ab compl
ps \<noteq> []
sps = sel gs bs ps (snd data)
hs = fst (add_indices (compl gs bs (ps -- sps) sps (snd data)) (snd data))
[PROOF STEP]
show "?l \<subseteq> ?r"
[PROOF STATE]
proof (prove)
using this:
struct_spec sel ap ab compl
ps \<noteq> []
sps = sel gs bs ps (snd data)
hs = fst (add_indices (compl gs bs (ps -- sps) sps (snd data)) (snd data))

goal (1 subgoal):
 1. component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')) \<subseteq> component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
by (rule components_subset_struct)
[PROOF STATE]
proof (state)
this:
component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')) \<subseteq> component_of_term ` Keys (args_to_set (gs, bs, ps))

goal (1 subgoal):
 1. component_of_term ` Keys (args_to_set (gs, bs, ps)) \<subseteq> component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data'))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. component_of_term ` Keys (args_to_set (gs, bs, ps)) \<subseteq> component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data'))
[PROOF STEP]
show "?r \<subseteq> ?l"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. component_of_term ` Keys (args_to_set (gs, bs, ps)) \<subseteq> component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data'))
[PROOF STEP]
by (simp add: args_to_set_subset_Times[OF rec2.prems] args_to_set_alt2[OF ap ab rec2.prems] image_Un,
          rule image_mono, rule Keys_mono, blast)
[PROOF STATE]
proof (state)
this:
component_of_term ` Keys (args_to_set (gs, bs, ps)) \<subseteq> component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data'))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')) = component_of_term ` Keys (args_to_set (gs, bs, ps))

goal (1 subgoal):
 1. \<And>bs ps sps aux hs rc data data' D D'. \<lbrakk>ps \<noteq> []; sps = sel gs bs ps (snd data); aux = compl gs bs (ps -- sps) sps (snd data); (hs, data') = add_indices aux (snd data); rc = fst data - count_const_lt_components (fst aux); 0 < rc; D' = D \<union> (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union> set (ps -- sps) -\<^sub>p set (ap gs bs (ps -- sps) hs data')); set (ap gs bs (ps -- sps) hs data') \<subseteq> set (ab gs bs hs data') \<times> (set gs \<union> set (ab gs bs hs data')) \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')); set ps \<subseteq> set bs \<times> (set gs \<union> set bs)\<rbrakk> \<Longrightarrow> component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
with rec2.hyps(8)[OF sub]
[PROOF STATE]
proof (chain)
picking this:
component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data'))
component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data'))
component_of_term ` Keys (args_to_set (gs, ab gs bs hs data', ap gs bs (ps -- sps) hs data')) = component_of_term ` Keys (args_to_set (gs, bs, ps))

goal (1 subgoal):
 1. component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))
[PROOF STEP]
by (rule trans)
[PROOF STATE]
proof (state)
this:
component_of_term ` Keys (fst ` set (fst (gb_schema_dummy (rc, data') D' (ab gs bs hs data') (ap gs bs (ps -- sps) hs data')))) = component_of_term ` Keys (args_to_set (gs, bs, ps))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Kab_authentic:
     "\<lbrakk> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>
           \<in> parts (spies evs);
         A \<notin> bad;  evs \<in> bankerberos \<rbrakk>
       \<Longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>)
             \<in> set evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evs); A \<notin> bad; evs \<in> bankerberos\<rbrakk> \<Longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<notin> bad; evs \<in> bankerberos\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs
[PROOF STEP]
apply (erule bankerberos.induct)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. A \<notin> bad \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy []) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set []
 2. \<And>evsf Xa Ba. \<lbrakk>A \<notin> bad; evsf \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evsf; Xa \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Says Spy Ba Xa # evsf)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Says Spy Ba Xa # evsf)
 3. \<And>evs1 Aa Ba. \<lbrakk>A \<notin> bad; evs1 \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs1\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1)
 4. \<And>evs2 Ka A' Aa Ba. \<lbrakk>A \<notin> bad; evs2 \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs2; Key Ka \<notin> used evs2; Ka \<in> symKeys; Says A' Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Says Server Aa (Crypt (shrK Aa) \<lbrace>Number (CT evs2), Agent Ba, Key Ka, Crypt (shrK Ba) \<lbrace>Number (CT evs2), Agent Aa, Key Ka\<rbrace>\<rbrace>) # evs2)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Says Server Aa (Crypt (shrK Aa) \<lbrace>Number (CT evs2), Agent Ba, Key Ka, Crypt (shrK Ba) \<lbrace>Number (CT evs2), Agent Aa, Key Ka\<rbrace>\<rbrace>) # evs2)
 5. \<And>evs3 S Aa Tka Ba Ka Ticket. \<lbrakk>A \<notin> bad; evs3 \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs3; Says S Aa (Crypt (shrK Aa) \<lbrace>Number Tka, Agent Ba, Key Ka, Ticket\<rbrace>) \<in> set evs3; Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs3; \<not> expiredK Tka evs3\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Says Aa Ba \<lbrace>Ticket, Crypt Ka \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>\<rbrace> # evs3)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Says Aa Ba \<lbrace>Ticket, Crypt Ka \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>\<rbrace> # evs3)
 6. \<And>evs4 A' Ba Tka Aa Ka Ta. \<lbrakk>A \<notin> bad; evs4 \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs4; Says A' Ba \<lbrace>Crypt (shrK Ba) \<lbrace>Number Tka, Agent Aa, Key Ka\<rbrace>, Crypt Ka \<lbrace>Agent Aa, Number Ta\<rbrace>\<rbrace> \<in> set evs4; \<not> expiredK Tka evs4; \<not> expiredA Ta evs4\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Says Ba Aa (Crypt Ka (Number Ta)) # evs4)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Says Ba Aa (Crypt Ka (Number Ta)) # evs4)
 7. \<And>evso Aa Tka Ba Ka Ticket. \<lbrakk>A \<notin> bad; evso \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evso) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evso; Says Server Aa (Crypt (shrK Aa) \<lbrace>Number Tka, Agent Ba, Key Ka, Ticket\<rbrace>) \<in> set evso; expiredK Tka evso\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Notes Spy \<lbrace>Number Tka, Key Ka\<rbrace> # evso)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Notes Spy \<lbrace>Number Tka, Key Ka\<rbrace> # evso)
[PROOF STEP]
apply (frule_tac [7] Oops_parts_spies)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. A \<notin> bad \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy []) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set []
 2. \<And>evsf Xa Ba. \<lbrakk>A \<notin> bad; evsf \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evsf; Xa \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Says Spy Ba Xa # evsf)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Says Spy Ba Xa # evsf)
 3. \<And>evs1 Aa Ba. \<lbrakk>A \<notin> bad; evs1 \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs1\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1)
 4. \<And>evs2 Ka A' Aa Ba. \<lbrakk>A \<notin> bad; evs2 \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs2; Key Ka \<notin> used evs2; Ka \<in> symKeys; Says A' Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Says Server Aa (Crypt (shrK Aa) \<lbrace>Number (CT evs2), Agent Ba, Key Ka, Crypt (shrK Ba) \<lbrace>Number (CT evs2), Agent Aa, Key Ka\<rbrace>\<rbrace>) # evs2)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Says Server Aa (Crypt (shrK Aa) \<lbrace>Number (CT evs2), Agent Ba, Key Ka, Crypt (shrK Ba) \<lbrace>Number (CT evs2), Agent Aa, Key Ka\<rbrace>\<rbrace>) # evs2)
 5. \<And>evs3 S Aa Tka Ba Ka Ticket. \<lbrakk>A \<notin> bad; evs3 \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs3; Says S Aa (Crypt (shrK Aa) \<lbrace>Number Tka, Agent Ba, Key Ka, Ticket\<rbrace>) \<in> set evs3; Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs3; \<not> expiredK Tka evs3\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Says Aa Ba \<lbrace>Ticket, Crypt Ka \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>\<rbrace> # evs3)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Says Aa Ba \<lbrace>Ticket, Crypt Ka \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>\<rbrace> # evs3)
 6. \<And>evs4 A' Ba Tka Aa Ka Ta. \<lbrakk>A \<notin> bad; evs4 \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evs4; Says A' Ba \<lbrace>Crypt (shrK Ba) \<lbrace>Number Tka, Agent Aa, Key Ka\<rbrace>, Crypt Ka \<lbrace>Agent Aa, Number Ta\<rbrace>\<rbrace> \<in> set evs4; \<not> expiredK Tka evs4; \<not> expiredA Ta evs4\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Says Ba Aa (Crypt Ka (Number Ta)) # evs4)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Says Ba Aa (Crypt Ka (Number Ta)) # evs4)
 7. \<And>evso Aa Tka Ba Ka Ticket. \<lbrakk>A \<notin> bad; evso \<in> bankerberos; Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy evso) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set evso; Says Server Aa (Crypt (shrK Aa) \<lbrace>Number Tka, Agent Ba, Key Ka, Ticket\<rbrace>) \<in> set evso; expiredK Tka evso; Key Ka \<in> parts (knows Spy evso)\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace> \<in> parts (knows Spy (Notes Spy \<lbrace>Number Tka, Key Ka\<rbrace> # evso)) \<longrightarrow> Says Server A (Crypt (shrK A) \<lbrace>Number Tk, Agent B, Key K, X\<rbrace>) \<in> set (Notes Spy \<lbrace>Number Tka, Key Ka\<rbrace> # evso)
[PROOF STEP]
apply (frule_tac [5] BK3_msg_in_parts_spies, simp_all, blast)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma new_character_data_type_wf_preserved [simp]:
  "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> CharacterDataClass.type_wf h = CharacterDataClass.type_wf h'
[PROOF STEP]
apply(auto simp add: new_character_data_def new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
      elim!: bind_returns_heap_E type_wf_put_ptr_not_in_heap_E
      intro!: type_wf_put_I ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I
      split: if_splits)[1]
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ElementClass.type_wf h
 2. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> NodeClass.type_wf h
 3. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 4. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> is_node_kind (cast (cast (create_character_data_obj [])))
 5. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h))) |\<in>| character_data_ptr_kinds h\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply(simp_all add: type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs is_node_kind_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h))) |\<in>| character_data_ptr_kinds h\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
by (meson new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ptr_not_in_heap)


[STATEMENT]
lemma "\<forall>x. f x y = f y x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x. f x y = f y x
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x. f x y = f y x
[PROOF STEP]
oops


[STATEMENT]
lemma LeadsTo_Diff_fixedpoint:
     "Rprg \<in> ((metric-`{m}) - fixedpoint) LeadsTo (metric-`(lessThan m))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Rprg \<in> metric -` {m} - fixedpoint \<longmapsto>w metric -` {..<m}
[PROOF STEP]
apply (simp (no_asm) add: Diff_fixedpoint Rprg_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_total_program ({\<lambda>v. v = init}, \<Union>x\<in>edges. case x of (u, v) \<Rightarrow> {asgt u v}, UNIV) \<in> (\<Union>x\<in>edges. case x of (u, v) \<Rightarrow> metric -` {m} \<inter> {s. s u \<and> \<not> s v}) \<longmapsto>w metric -` {..<m}
[PROOF STEP]
apply (rule LeadsTo_UN, auto)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b. (a, b) \<in> edges \<Longrightarrow> mk_total_program ({\<lambda>v. v = init}, \<Union>x\<in>edges. case x of (u, v) \<Rightarrow> {asgt u v}, UNIV) \<in> metric -` {m} \<inter> {s. s a \<and> \<not> s b} \<longmapsto>w metric -` {..<m}
[PROOF STEP]
apply (ensures_tac "asgt a b")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b s aa ba. \<lbrakk>(a, b) \<in> edges; (aa, ba) \<in> edges; m = metric s; s a; \<not> s b; \<not> metric (s(ba := s aa \<or> s ba)) < metric s\<rbrakk> \<Longrightarrow> (b = ba \<longrightarrow> (a = ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> (s aa \<or> s ba) \<and> \<not> s aa \<and> \<not> s ba) \<and> (a \<noteq> ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> \<not> s aa \<and> \<not> s ba)) \<and> (b \<noteq> ba \<longrightarrow> (a = ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> (s aa \<or> s ba)) \<and> (a \<noteq> ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s))
 2. \<And>a b. (a, b) \<in> edges \<Longrightarrow> asgt a b = Id \<or> (\<exists>x\<in>edges. asgt a b \<in> (case x of (u, v) \<Rightarrow> {asgt u v}))
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b. (a, b) \<in> edges \<Longrightarrow> asgt a b = Id \<or> (\<exists>x\<in>edges. asgt a b \<in> (case x of (u, v) \<Rightarrow> {asgt u v}))
 2. \<And>a b s aa ba. \<lbrakk>(a, b) \<in> edges; (aa, ba) \<in> edges; m = metric s; s a; \<not> s b; \<not> metric (s(ba := s aa \<or> s ba)) < metric s\<rbrakk> \<Longrightarrow> (b = ba \<longrightarrow> (a = ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> (s aa \<or> s ba) \<and> \<not> s aa \<and> \<not> s ba) \<and> (a \<noteq> ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> \<not> s aa \<and> \<not> s ba)) \<and> (b \<noteq> ba \<longrightarrow> (a = ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> (s aa \<or> s ba)) \<and> (a \<noteq> ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s))
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b s aa ba. \<lbrakk>(a, b) \<in> edges; (aa, ba) \<in> edges; m = metric s; s a; \<not> s b; \<not> metric (s(ba := s aa \<or> s ba)) < metric s\<rbrakk> \<Longrightarrow> (b = ba \<longrightarrow> (a = ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> (s aa \<or> s ba) \<and> \<not> s aa \<and> \<not> s ba) \<and> (a \<noteq> ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> \<not> s aa \<and> \<not> s ba)) \<and> (b \<noteq> ba \<longrightarrow> (a = ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> (s aa \<or> s ba)) \<and> (a \<noteq> ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s))
[PROOF STEP]
apply (simp (no_asm_use) add: linorder_not_less)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b s aa ba. \<lbrakk>(a, b) \<in> edges; (aa, ba) \<in> edges; m = metric s; s a; \<not> s b; metric s \<le> metric (s(ba := s aa \<or> s ba))\<rbrakk> \<Longrightarrow> (b = ba \<longrightarrow> (a = ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> (s aa \<or> s ba) \<and> \<not> s aa \<and> \<not> s ba) \<and> (a \<noteq> ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> \<not> s aa \<and> \<not> s ba)) \<and> (b \<noteq> ba \<longrightarrow> (a = ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> (s aa \<or> s ba)) \<and> (a \<noteq> ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s))
[PROOF STEP]
apply (drule metric_le [THEN order_antisym])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b s aa ba. \<lbrakk>(a, b) \<in> edges; (aa, ba) \<in> edges; m = metric s; s a; \<not> s b; metric (s(ba := s aa \<or> s ba)) = metric s\<rbrakk> \<Longrightarrow> (b = ba \<longrightarrow> (a = ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> (s aa \<or> s ba) \<and> \<not> s aa \<and> \<not> s ba) \<and> (a \<noteq> ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> \<not> s aa \<and> \<not> s ba)) \<and> (b \<noteq> ba \<longrightarrow> (a = ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s \<and> (s aa \<or> s ba)) \<and> (a \<noteq> ba \<longrightarrow> metric (s(ba := s aa \<or> s ba)) = metric s))
[PROOF STEP]
apply (auto elim: less_not_refl3 [THEN [2] rev_notE])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma Signed_PReq_imp_Says_Cardholder:
     "[| MsgDualSign = \<lbrace>Hash PIData, Hash OIData\<rbrace>;
         OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>;
         PIHead = \<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent M,
                    TransStain\<rbrace>;
         PIData = \<lbrace>PIHead, PANData\<rbrace>;
         Crypt (priSK C) (Hash MsgDualSign) \<in> parts (knows Spy evs);
         M = Merchant i;  C = Cardholder k;  C \<notin> bad;  evs \<in> set_pur|]
      ==> \<exists>KC EKj.
            Says C M \<lbrace>\<lbrace>sign (priSK C) MsgDualSign,
                       EXcrypt KC EKj \<lbrace>PIHead, Hash OIData\<rbrace> PANData\<rbrace>,
                       OIData, Hash PIData\<rbrace>
              \<in> set evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>MsgDualSign = \<lbrace>Hash PIData, Hash OIData\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>; PIHead = \<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent M, TransStain\<rbrace>; PIData = \<lbrace>PIHead, PANData\<rbrace>; Crypt (priSK C) (Hash MsgDualSign) \<in> parts (knows Spy evs); M = Merchant i; C = Cardholder k; C \<notin> bad; evs \<in> set_pur\<rbrakk> \<Longrightarrow> \<exists>KC EKj. Says C M \<lbrace>\<lbrace>sign (priSK C) MsgDualSign, EXcrypt KC EKj \<lbrace>PIHead, Hash OIData\<rbrace> PANData\<rbrace>, OIData, Hash PIData\<rbrace> \<in> set evs
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>PIHead = \<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>; PIData = \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>; Crypt (priSK (Cardholder k)) (Hash \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace>) \<in> parts (knows Spy evs); C = Cardholder k; Cardholder k \<notin> bad; evs \<in> set_pur; MsgDualSign = \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>; M = Merchant i\<rbrakk> \<Longrightarrow> \<exists>KC EKj. Says (Cardholder k) (Merchant i) \<lbrace>\<lbrace>sign (priSK (Cardholder k)) \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace>, EXcrypt KC EKj \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace> PANData\<rbrace>, \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>\<rbrace> \<in> set evs
[PROOF STEP]
apply hypsubst_thin
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Crypt (priSK (Cardholder k)) (Hash \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace>) \<in> parts (knows Spy evs); Cardholder k \<notin> bad; evs \<in> set_pur\<rbrakk> \<Longrightarrow> \<exists>KC EKj. Says (Cardholder k) (Merchant i) \<lbrace>\<lbrace>sign (priSK (Cardholder k)) \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace>, EXcrypt KC EKj \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace> PANData\<rbrace>, \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>\<rbrace> \<in> set evs
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Cardholder k \<notin> bad; evs \<in> set_pur\<rbrakk> \<Longrightarrow> Crypt (priSK (Cardholder k)) (Hash \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace>) \<in> parts (knows Spy evs) \<longrightarrow> (\<exists>KC EKj. Says (Cardholder k) (Merchant i) \<lbrace>\<lbrace>sign (priSK (Cardholder k)) \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace>, EXcrypt KC EKj \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace> PANData\<rbrace>, \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>\<rbrace> \<in> set evs)
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. evs \<in> set_pur \<Longrightarrow> Cardholder k \<notin> bad \<longrightarrow> Crypt (priSK (Cardholder k)) (Hash \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace>) \<in> parts (knows Spy evs) \<longrightarrow> (\<exists>KC EKj. Says (Cardholder k) (Merchant i) \<lbrace>\<lbrace>sign (priSK (Cardholder k)) \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace>, EXcrypt KC EKj \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>\<rbrace> PANData\<rbrace>, \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, etc\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent (Merchant i), TransStain\<rbrace>, PANData\<rbrace>\<rbrace> \<in> set evs)
[PROOF STEP]
apply (erule set_pur.induct, simp_all, auto)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma normalize_positive_src_ports:
    assumes generic: "primitive_matcher_generic \<beta>"
    and n: "normalized_nnf_match m"
    and noneg: "\<not> has_disc_negated is_Src_Ports False m"
    shows
        "match_list (\<beta>, \<alpha>) (normalize_positive_src_ports m) a p \<longleftrightarrow> matches (\<beta>, \<alpha>) m a p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match_list (\<beta>, \<alpha>) (normalize_positive_src_ports m) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(simp add: normalize_positive_src_ports_def normalize_positive_ports_step_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match_list (\<beta>, \<alpha>) (case primitive_extractor (is_Src_Ports, src_ports_sel) m of (spts, rst) \<Rightarrow> case getNeg spts of [] \<Rightarrow> case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(case_tac "primitive_extractor (is_Src_Ports, src_ports_sel) m", rename_tac spts rst)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>spts rst. primitive_extractor (is_Src_Ports, src_ports_sel) m = (spts, rst) \<Longrightarrow> match_list (\<beta>, \<alpha>) (case primitive_extractor (is_Src_Ports, src_ports_sel) m of (spts, rst) \<Rightarrow> case getNeg spts of [] \<Rightarrow> case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>spts rst. primitive_extractor (is_Src_Ports, src_ports_sel) m = (spts, rst) \<Longrightarrow> match_list (\<beta>, \<alpha>) (case getNeg spts of [] \<Rightarrow> case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(subgoal_tac "getNeg spts = []")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>spts rst. \<lbrakk>primitive_extractor (is_Src_Ports, src_ports_sel) m = (spts, rst); getNeg spts = []\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case getNeg spts of [] \<Rightarrow> case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
 2. \<And>spts rst. primitive_extractor (is_Src_Ports, src_ports_sel) m = (spts, rst) \<Longrightarrow> getNeg spts = []
[PROOF STEP]
(*needs assumption for this step *)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>spts rst. \<lbrakk>primitive_extractor (is_Src_Ports, src_ports_sel) m = (spts, rst); getNeg spts = []\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case getNeg spts of [] \<Rightarrow> case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
 2. \<And>spts rst. primitive_extractor (is_Src_Ports, src_ports_sel) m = (spts, rst) \<Longrightarrow> getNeg spts = []
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>spts rst. primitive_extractor (is_Src_Ports, src_ports_sel) m = (spts, rst) \<Longrightarrow> getNeg spts = []
 2. \<And>spts rst. \<lbrakk>primitive_extractor (is_Src_Ports, src_ports_sel) m = (spts, rst); getNeg spts = []\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case getNeg spts of [] \<Rightarrow> case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. primitive_extractor (is_Src_Ports, src_ports_sel) m = (spts_, rst_) \<Longrightarrow> getNeg spts_ = []
[PROOF STEP]
apply(drule primitive_extractor_correct(8)[OF n wf_disc_sel_common_primitive(1)])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<not> has_disc_negated is_Src_Ports False m) = (getNeg spts_ = []) \<Longrightarrow> getNeg spts_ = []
[PROOF STEP]
using noneg
[PROOF STATE]
proof (prove)
using this:
\<not> has_disc_negated is_Src_Ports False m

goal (1 subgoal):
 1. (\<not> has_disc_negated is_Src_Ports False m) = (getNeg spts_ = []) \<Longrightarrow> getNeg spts_ = []
[PROOF STEP]
by simp+
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>spts rst. \<lbrakk>primitive_extractor (is_Src_Ports, src_ports_sel) m = (spts, rst); getNeg spts = []\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case getNeg spts of [] \<Rightarrow> case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>spts rst. \<lbrakk>primitive_extractor (is_Src_Ports, src_ports_sel) m = (spts, rst); getNeg spts = []\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(drule primitive_extractor_correct(1)[OF n wf_disc_sel_common_primitive(1), where \<gamma>="(\<beta>, \<alpha>)" and a=a and p=p])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>spts rst. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(case_tac "l4_ports_compress (getPos spts)")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>spts rst. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = CannotMatch\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
 2. \<And>spts rst. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchesAll\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
 3. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchExpr x3\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>spts rst. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = CannotMatch\<rbrakk> \<Longrightarrow> \<not> matches (\<beta>, \<alpha>) m a p
 2. \<And>spts rst. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchesAll\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
 3. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchExpr x3\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(drule raw_ports_compress_src_CannotMatch[OF generic, where \<alpha>=\<alpha> and a=a and p=p])
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>spts rst. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; \<not> matches (\<beta>, \<alpha>) (alist_and (map (Pos \<circ> Src_Ports) (getPos spts))) a p\<rbrakk> \<Longrightarrow> \<not> matches (\<beta>, \<alpha>) m a p
 2. \<And>spts rst. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchesAll\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
 3. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchExpr x3\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(simp add: noNeg_mapNegPos_helper; fail)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>spts rst. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchesAll\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
 2. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchExpr x3\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>spts rst. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchesAll\<rbrakk> \<Longrightarrow> (matches (\<beta>, \<alpha>) rst a p \<longrightarrow> matches (\<beta>, \<alpha>) m a p) \<and> (\<not> matches (\<beta>, \<alpha>) rst a p \<longrightarrow> \<not> matches (\<beta>, \<alpha>) m a p)
 2. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchExpr x3\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(drule raw_ports_compress_MatchesAll[OF generic, where \<alpha>=\<alpha> and a=a and p=p])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>spts rst. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; matches (\<beta>, \<alpha>) (alist_and (map (Pos \<circ> Src_Ports) (getPos spts))) a p\<rbrakk> \<Longrightarrow> (matches (\<beta>, \<alpha>) rst a p \<longrightarrow> matches (\<beta>, \<alpha>) m a p) \<and> (\<not> matches (\<beta>, \<alpha>) rst a p \<longrightarrow> \<not> matches (\<beta>, \<alpha>) m a p)
 2. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchExpr x3\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(simp add: noNeg_mapNegPos_helper; fail)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchExpr x3\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (case l4_ports_compress (getPos spts) of CannotMatch \<Rightarrow> [] | MatchesAll \<Rightarrow> [rst] | MatchExpr m \<Rightarrow> map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports m)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(simp add: bunch_of_lemmata_about_matches)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; l4_ports_compress (getPos spts) = MatchExpr x3\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports x3)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(drule raw_ports_compress_src_MatchExpr[OF generic, where \<alpha>=\<alpha> and a=a and p=p])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; matches (\<beta>, \<alpha>) (Match (Src_Ports x3)) a p = matches (\<beta>, \<alpha>) (alist_and (map (Pos \<circ> Src_Ports) (getPos spts))) a p\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports x3)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(insert singletonize_L4Ports_src[OF generic, where \<alpha>=\<alpha> and a=a and p=p])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; matches (\<beta>, \<alpha>) (Match (Src_Ports x3)) a p = matches (\<beta>, \<alpha>) (alist_and (map (Pos \<circ> Src_Ports) (getPos spts))) a p; \<And>pts. match_list (\<beta>, \<alpha>) (map (Match \<circ> Src_Ports) (singletonize_L4Ports pts)) a p = matches (\<beta>, \<alpha>) (Match (Src_Ports pts)) a p\<rbrakk> \<Longrightarrow> match_list (\<beta>, \<alpha>) (map (\<lambda>spt. MatchAnd (Match (Src_Ports spt)) rst) (singletonize_L4Ports x3)) a p = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(simp add: match_list_matches)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; matches (\<beta>, \<alpha>) (Match (Src_Ports x3)) a p = matches (\<beta>, \<alpha>) (alist_and (map (Pos \<circ> Src_Ports) (getPos spts))) a p; \<And>pts. (\<exists>m\<in>set (singletonize_L4Ports pts). matches (\<beta>, \<alpha>) (Match (Src_Ports m)) a p) = matches (\<beta>, \<alpha>) (Match (Src_Ports pts)) a p\<rbrakk> \<Longrightarrow> (\<exists>m\<in>set (singletonize_L4Ports x3). matches (\<beta>, \<alpha>) (MatchAnd (Match (Src_Ports m)) rst) a p) = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(simp add: bunch_of_lemmata_about_matches)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>spts rst x3. \<lbrakk>getNeg spts = []; (matches (\<beta>, \<alpha>) (alist_and (NegPos_map Src_Ports spts)) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p; matches (\<beta>, \<alpha>) (Match (Src_Ports x3)) a p = matches (\<beta>, \<alpha>) (alist_and (map (Pos \<circ> Src_Ports) (getPos spts))) a p; \<And>pts. (\<exists>m\<in>set (singletonize_L4Ports pts). matches (\<beta>, \<alpha>) (Match (Src_Ports m)) a p) = matches (\<beta>, \<alpha>) (Match (Src_Ports pts)) a p\<rbrakk> \<Longrightarrow> (matches (\<beta>, \<alpha>) (alist_and (map (Pos \<circ> Src_Ports) (getPos spts))) a p \<and> matches (\<beta>, \<alpha>) rst a p) = matches (\<beta>, \<alpha>) m a p
[PROOF STEP]
apply(simp add: noNeg_mapNegPos_helper; fail)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma heap_colours_alloc[simp]:
  "\<lbrakk> heap (s sys) r' = None; valid_refs_inv s \<rbrakk>
  \<Longrightarrow> black_heap (s(mutator m := s (mutator m)\<lparr>roots := roots'\<rparr>, sys := s sys\<lparr>heap := sys_heap s(r' \<mapsto> \<lparr>obj_mark = fl, obj_fields = Map.empty, obj_payload = Map.empty\<rparr>)\<rparr>))
  \<longleftrightarrow> black_heap s \<and> fl = sys_fM s"
  "heap (s sys) r' = None
  \<Longrightarrow> white_heap (s(mutator m := s (mutator m)\<lparr>roots := roots'\<rparr>, sys := s sys\<lparr>heap := sys_heap s(r' \<mapsto> \<lparr>obj_mark = fl, obj_fields = Map.empty, obj_payload = Map.empty\<rparr>)\<rparr>))
  \<longleftrightarrow> white_heap s \<and> fl \<noteq> sys_fM s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lbrakk>sys_heap s r' = None; valid_refs_inv s\<rbrakk> \<Longrightarrow> black_heap (s(mutator m := s (mutator m)\<lparr>roots := roots'\<rparr>, sys := s sys\<lparr>heap := sys_heap s(r' \<mapsto> \<lparr>obj_mark = fl, obj_fields = Map.empty, obj_payload = Map.empty\<rparr>)\<rparr>)) = (black_heap s \<and> fl = sys_fM s)) &&& (sys_heap s r' = None \<Longrightarrow> white_heap (s(mutator m := s (mutator m)\<lparr>roots := roots'\<rparr>, sys := s sys\<lparr>heap := sys_heap s(r' \<mapsto> \<lparr>obj_mark = fl, obj_fields = Map.empty, obj_payload = Map.empty\<rparr>)\<rparr>)) = (white_heap s \<and> fl \<noteq> sys_fM s))
[PROOF STEP]
unfolding black_heap_def white_def white_heap_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lbrakk>sys_heap s r' = None; valid_refs_inv s\<rbrakk> \<Longrightarrow> (\<forall>x. obj_at (\<lambda>s. True) x (s(mutator m := s (mutator m)\<lparr>roots := roots'\<rparr>, sys := s sys\<lparr>heap := sys_heap s(r' \<mapsto> \<lparr>obj_mark = fl, obj_fields = Map.empty, obj_payload = Map.empty\<rparr>)\<rparr>)) \<longrightarrow> black x (s(mutator m := s (mutator m)\<lparr>roots := roots'\<rparr>, sys := s sys\<lparr>heap := sys_heap s(r' \<mapsto> \<lparr>obj_mark = fl, obj_fields = Map.empty, obj_payload = Map.empty\<rparr>)\<rparr>))) = ((\<forall>x. obj_at (\<lambda>s. True) x s \<longrightarrow> black x s) \<and> fl = sys_fM s)) &&& (sys_heap s r' = None \<Longrightarrow> (\<forall>x. obj_at (\<lambda>s. True) x (s(mutator m := s (mutator m)\<lparr>roots := roots'\<rparr>, sys := s sys\<lparr>heap := sys_heap s(r' \<mapsto> \<lparr>obj_mark = fl, obj_fields = Map.empty, obj_payload = Map.empty\<rparr>)\<rparr>)) \<longrightarrow> obj_at (\<lambda>obj. obj_mark obj \<noteq> sys_fM (s(mutator m := s (mutator m)\<lparr>roots := roots'\<rparr>, sys := s sys\<lparr>heap := sys_heap s(r' \<mapsto> \<lparr>obj_mark = fl, obj_fields = Map.empty, obj_payload = Map.empty\<rparr>)\<rparr>))) x (s(mutator m := s (mutator m)\<lparr>roots := roots'\<rparr>, sys := s sys\<lparr>heap := sys_heap s(r' \<mapsto> \<lparr>obj_mark = fl, obj_fields = Map.empty, obj_payload = Map.empty\<rparr>)\<rparr>))) = ((\<forall>x. obj_at (\<lambda>s. True) x s \<longrightarrow> obj_at (\<lambda>obj. obj_mark obj \<noteq> sys_fM s) x s) \<and> fl \<noteq> sys_fM s))
[PROOF STEP]
apply (simp_all add: fun_upd_apply split: obj_at_splits)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>sys_heap s r' = None; valid_refs_inv s\<rbrakk> \<Longrightarrow> (\<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))) = ((\<forall>x. (\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> black x s) \<and> fl = sys_fM s)
 2. sys_heap s r' = None \<Longrightarrow> (\<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))) = ((\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s))
[PROOF STEP]
apply (rule iffI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> black x s) \<and> fl = sys_fM s
 2. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; (\<forall>x. (\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> black x s) \<and> fl = sys_fM s\<rbrakk> \<Longrightarrow> \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))
 3. sys_heap s r' = None \<Longrightarrow> (\<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))) = ((\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s))
[PROOF STEP]
apply (intro allI conjI impI)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s)); \<exists>obj. sys_heap s x = Some obj\<rbrakk> \<Longrightarrow> black x s
 2. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))\<rbrakk> \<Longrightarrow> fl = sys_fM s
 3. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; (\<forall>x. (\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> black x s) \<and> fl = sys_fM s\<rbrakk> \<Longrightarrow> \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))
 4. sys_heap s r' = None \<Longrightarrow> (\<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))) = ((\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s))
[PROOF STEP]
apply (rename_tac x)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s)); \<exists>obj. sys_heap s x = Some obj\<rbrakk> \<Longrightarrow> black x s
 2. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))\<rbrakk> \<Longrightarrow> fl = sys_fM s
 3. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; (\<forall>x. (\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> black x s) \<and> fl = sys_fM s\<rbrakk> \<Longrightarrow> \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))
 4. sys_heap s r' = None \<Longrightarrow> (\<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))) = ((\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s))
[PROOF STEP]
apply (drule_tac x=x in spec)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; \<exists>obj. sys_heap s x = Some obj; (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))\<rbrakk> \<Longrightarrow> black x s
 2. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))\<rbrakk> \<Longrightarrow> fl = sys_fM s
 3. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; (\<forall>x. (\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> black x s) \<and> fl = sys_fM s\<rbrakk> \<Longrightarrow> \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))
 4. sys_heap s r' = None \<Longrightarrow> (\<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))) = ((\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s))
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))\<rbrakk> \<Longrightarrow> fl = sys_fM s
 2. \<lbrakk>sys_heap s r' = None; valid_refs_inv s; (\<forall>x. (\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> black x s) \<and> fl = sys_fM s\<rbrakk> \<Longrightarrow> \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s) \<and> ((\<exists>obj. sys_heap s x = Some obj) \<longrightarrow> (black x s \<or> r' = x \<and> fl = sys_fM s \<and> \<not> grey r' s) \<and> (x = r' \<longrightarrow> black r' s \<or> fl = sys_fM s \<and> \<not> grey r' s))
 3. sys_heap s r' = None \<Longrightarrow> (\<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))) = ((\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s))
[PROOF STEP]
apply (drule spec[where x=r'], auto simp: reaches_def dest!: valid_refs_invD split: obj_at_splits)[2]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sys_heap s r' = None \<Longrightarrow> (\<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))) = ((\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s))
[PROOF STEP]
apply (rule iffI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>sys_heap s r' = None; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))\<rbrakk> \<Longrightarrow> (\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s)
 2. \<lbrakk>sys_heap s r' = None; (\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s)\<rbrakk> \<Longrightarrow> \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))
[PROOF STEP]
apply (intro allI conjI impI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x obj. \<lbrakk>sys_heap s r' = None; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s))); sys_heap s x = Some obj\<rbrakk> \<Longrightarrow> obj_mark obj = (\<not> sys_fM s)
 2. \<lbrakk>sys_heap s r' = None; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))\<rbrakk> \<Longrightarrow> fl = (\<not> sys_fM s)
 3. \<lbrakk>sys_heap s r' = None; (\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s)\<rbrakk> \<Longrightarrow> \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))
[PROOF STEP]
apply (rename_tac x obj)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x obj. \<lbrakk>sys_heap s r' = None; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s))); sys_heap s x = Some obj\<rbrakk> \<Longrightarrow> obj_mark obj = (\<not> sys_fM s)
 2. \<lbrakk>sys_heap s r' = None; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))\<rbrakk> \<Longrightarrow> fl = (\<not> sys_fM s)
 3. \<lbrakk>sys_heap s r' = None; (\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s)\<rbrakk> \<Longrightarrow> \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))
[PROOF STEP]
apply (drule_tac x=x in spec)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x obj. \<lbrakk>sys_heap s r' = None; sys_heap s x = Some obj; (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))\<rbrakk> \<Longrightarrow> obj_mark obj = (\<not> sys_fM s)
 2. \<lbrakk>sys_heap s r' = None; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))\<rbrakk> \<Longrightarrow> fl = (\<not> sys_fM s)
 3. \<lbrakk>sys_heap s r' = None; (\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s)\<rbrakk> \<Longrightarrow> \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>sys_heap s r' = None; \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))\<rbrakk> \<Longrightarrow> fl = (\<not> sys_fM s)
 2. \<lbrakk>sys_heap s r' = None; (\<forall>x obj. sys_heap s x = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s)) \<and> fl = (\<not> sys_fM s)\<rbrakk> \<Longrightarrow> \<forall>x. (sys_heap s x = None \<longrightarrow> x = r' \<longrightarrow> fl = (\<not> sys_fM s)) \<and> (\<forall>obj. sys_heap s x = Some obj \<longrightarrow> (obj_mark obj = (\<not> sys_fM s) \<or> x = r' \<and> fl = (\<not> sys_fM s)) \<and> (x = r' \<longrightarrow> fl = (\<not> sys_fM s)))
[PROOF STEP]
apply (drule spec[where x=r'], auto dest!: valid_refs_invD split: obj_at_splits)[2]
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done