[STATEMENT]
lemma Says_Kas_message_form:
     "\<lbrakk> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace>
           \<in> set evs;
         evs \<in> kerbV \<rbrakk>
      \<Longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs \<and> authK \<in> symKeys \<and>
  authTicket = (Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace>) \<and>
             K = shrK A  \<and> Peer = Tgs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs; evs \<in> kerbV\<rbrakk> \<Longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. evs \<in> kerbV \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
[PROOF STEP]
apply (erule kerbV.induct)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set [] \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys [] \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 2. \<And>evsf X B. \<lbrakk>evsf \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evsf \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evsf \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set (Says Spy B X # evsf) \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys (Says Spy B X # evsf) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 3. \<And>evs1 Aa. \<lbrakk>evs1 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs1 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs1 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set (Says Aa Kas \<lbrace>Agent Aa, Agent Tgs, Number (CT evs1)\<rbrace> # evs1) \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys (Says Aa Kas \<lbrace>Agent Aa, Agent Tgs, Number (CT evs1)\<rbrace> # evs1) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 4. \<And>evs2 authKa A' Aa T1. \<lbrakk>evs2 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs2 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs2 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; Key authKa \<notin> used evs2; authKa \<in> symKeys; Says A' Kas \<lbrace>Agent Aa, Agent Tgs, Number T1\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set (Says Kas Aa \<lbrace>Crypt (shrK Aa) \<lbrace>Key authKa, Agent Tgs, Number (CT evs2)\<rbrace>, Crypt (shrK Tgs) \<lbrace>Agent Aa, Agent Tgs, Key authKa, Number (CT evs2)\<rbrace>\<rbrace> # evs2) \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys (Says Kas Aa \<lbrace>Crypt (shrK Aa) \<lbrace>Key authKa, Agent Tgs, Number (CT evs2)\<rbrace>, Crypt (shrK Tgs) \<lbrace>Agent Aa, Agent Tgs, Key authKa, Number (CT evs2)\<rbrace>\<rbrace> # evs2) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 5. \<And>evs3 Aa T1 Kas' authKa Taa authTicketa B. \<lbrakk>evs3 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs3 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs3 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; Aa \<noteq> Kas; Aa \<noteq> Tgs; Says Aa Kas \<lbrace>Agent Aa, Agent Tgs, Number T1\<rbrace> \<in> set evs3; Says Kas' Aa \<lbrace>Crypt (shrK Aa) \<lbrace>Key authKa, Agent Tgs, Number Taa\<rbrace>, authTicketa\<rbrace> \<in> set evs3; valid Taa wrt T1\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set (Says Aa Tgs \<lbrace>authTicketa, Crypt authKa \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>, Agent B\<rbrace> # evs3) \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys (Says Aa Tgs \<lbrace>authTicketa, Crypt authKa \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>, Agent B\<rbrace> # evs3) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 6. \<And>evs4 servK B authKa A' Aa Taa T2. \<lbrakk>evs4 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs4 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs4 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; Key servK \<notin> used evs4; servK \<in> symKeys; B \<noteq> Tgs; authKa \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent Aa, Agent Tgs, Key authKa, Number Taa\<rbrace>, Crypt authKa \<lbrace>Agent Aa, Number T2\<rbrace>, Agent B\<rbrace> \<in> set evs4; \<not> expiredAK Taa evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Taa\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set (Says Tgs Aa \<lbrace>Crypt authKa \<lbrace>Key servK, Agent B, Number (CT evs4)\<rbrace>, Crypt (shrK B) \<lbrace>Agent Aa, Agent B, Key servK, Number (CT evs4)\<rbrace>\<rbrace> # evs4) \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys (Says Tgs Aa \<lbrace>Crypt authKa \<lbrace>Key servK, Agent B, Number (CT evs4)\<rbrace>, Crypt (shrK B) \<lbrace>Agent Aa, Agent B, Key servK, Number (CT evs4)\<rbrace>\<rbrace> # evs4) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 7. \<And>evs5 authKa servK Aa authTicketa T2 B Tgs' Ts servTicket. \<lbrakk>evs5 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs5 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs5 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; authKa \<in> symKeys; servK \<in> symKeys; Aa \<noteq> Kas; Aa \<noteq> Tgs; Says Aa Tgs \<lbrace>authTicketa, Crypt authKa \<lbrace>Agent Aa, Number T2\<rbrace>, Agent B\<rbrace> \<in> set evs5; Says Tgs' Aa \<lbrace>Crypt authKa \<lbrace>Key servK, Agent B, Number Ts\<rbrace>, servTicket\<rbrace> \<in> set evs5; valid Ts wrt T2\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set (Says Aa B \<lbrace>servTicket, Crypt servK \<lbrace>Agent Aa, Number (CT evs5)\<rbrace>\<rbrace> # evs5) \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys (Says Aa B \<lbrace>servTicket, Crypt servK \<lbrace>Agent Aa, Number (CT evs5)\<rbrace>\<rbrace> # evs5) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 8. \<And>evs6 B A' Aa servK Ts T3 Ta2. \<lbrakk>evs6 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs6 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs6 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; B \<noteq> Kas; B \<noteq> Tgs; Says A' B \<lbrace>Crypt (shrK B) \<lbrace>Agent Aa, Agent B, Key servK, Number Ts\<rbrace>, Crypt servK \<lbrace>Agent Aa, Number T3\<rbrace>\<rbrace> \<in> set evs6; \<not> expiredSK Ts evs6; \<not> expiredA T3 evs6\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set (Says B Aa (Crypt servK (Number Ta2)) # evs6) \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys (Says B Aa (Crypt servK (Number Ta2)) # evs6) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 9. \<And>evsO1 Aa authKa Taa authTicketa. \<lbrakk>evsO1 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evsO1 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evsO1 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; Aa \<noteq> Spy; Says Kas Aa \<lbrace>Crypt (shrK Aa) \<lbrace>Key authKa, Agent Tgs, Number Taa\<rbrace>, authTicketa\<rbrace> \<in> set evsO1; expiredAK Taa evsO1\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set (Notes Spy \<lbrace>Agent Aa, Agent Tgs, Number Taa, Key authKa\<rbrace> # evsO1) \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys (Notes Spy \<lbrace>Agent Aa, Agent Tgs, Number Taa, Key authKa\<rbrace> # evsO1) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 10. \<And>evsO2 Aa authKa servK B Ts servTicket. \<lbrakk>evsO2 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evsO2 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evsO2 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; Aa \<noteq> Spy; Says Tgs Aa \<lbrace>Crypt authKa \<lbrace>Key servK, Agent B, Number Ts\<rbrace>, servTicket\<rbrace> \<in> set evsO2; expiredSK Ts evsO2\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set (Notes Spy \<lbrace>Agent Aa, Agent B, Number Ts, Key servK\<rbrace> # evsO2) \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys (Notes Spy \<lbrace>Agent Aa, Agent B, Number Ts, Key servK\<rbrace> # evsO2) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
[PROOF STEP]
apply (simp_all (no_asm) add: authKeys_def authKeys_insert)
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<And>evsf X. \<lbrakk>evsf \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evsf \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evsf \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evsf \<longrightarrow> authK \<notin> range shrK \<and> (\<exists>A Peer Ta. Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Ta\<rbrace>\<rbrace> \<in> set evsf) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 2. \<And>evs1. \<lbrakk>evs1 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs1 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs1 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs1 \<longrightarrow> authK \<notin> range shrK \<and> (\<exists>A Peer Ta. Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Ta\<rbrace>\<rbrace> \<in> set evs1) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 3. \<And>evs2 authKa A' Aa T1. \<lbrakk>evs2 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs2 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs2 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; Key authKa \<notin> used evs2; authKa \<in> symKeys; Says A' Kas \<lbrace>Agent Aa, Agent Tgs, Number T1\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> (A = Aa \<and> K = shrK Aa \<and> authK = authKa \<and> Peer = Tgs \<and> Ta = Number (CT evs2) \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent Aa, Agent Tgs, Key authKa, Number (CT evs2)\<rbrace> \<longrightarrow> authKa \<notin> range shrK \<and> (\<exists>A Peer Ta. A = Aa \<and> Peer = Tgs \<and> Ta = Number (CT evs2) \<and> Peer = Tgs \<and> A = Aa \<and> Peer = Tgs \<and> Ta = Number (CT evs2) \<or> Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authKa, Agent Peer, Ta\<rbrace>, Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authKa, Ta\<rbrace>\<rbrace> \<in> set evs2) \<and> authKa \<in> symKeys) \<and> (Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs2 \<longrightarrow> authK \<notin> range shrK \<and> (\<exists>A Peer Ta. A = Aa \<and> authK = authKa \<and> Peer = Tgs \<and> Ta = Number (CT evs2) \<and> Peer = Tgs \<and> A = Aa \<and> Peer = Tgs \<and> authK = authKa \<and> Ta = Number (CT evs2) \<or> Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Ta\<rbrace>\<rbrace> \<in> set evs2) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs)
 4. \<And>evs3 Aa T1 Kas' authKa Taa authTicketa B. \<lbrakk>evs3 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs3 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs3 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; Aa \<noteq> Kas; Aa \<noteq> Tgs; Says Aa Kas \<lbrace>Agent Aa, Agent Tgs, Number T1\<rbrace> \<in> set evs3; Says Kas' Aa \<lbrace>Crypt (shrK Aa) \<lbrace>Key authKa, Agent Tgs, Number Taa\<rbrace>, authTicketa\<rbrace> \<in> set evs3; valid Taa wrt T1\<rbrakk> \<Longrightarrow> (Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace> = authTicketa \<longrightarrow> A = Tgs \<longrightarrow> Kas = Aa \<longrightarrow> authTicket \<noteq> \<lbrace>Crypt authKa \<lbrace>Agent Kas, Number (CT evs3)\<rbrace>, Agent B\<rbrace>) \<and> (Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs3 \<longrightarrow> authK \<notin> range shrK \<and> (\<exists>A Peer Ta. Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Ta\<rbrace>\<rbrace> \<in> set evs3) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs)
 5. \<And>evs4 servK B authKa A' Aa Taa T2. \<lbrakk>evs4 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs4 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs4 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; Key servK \<notin> used evs4; servK \<in> symKeys; B \<noteq> Tgs; authKa \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent Aa, Agent Tgs, Key authKa, Number Taa\<rbrace>, Crypt authKa \<lbrace>Agent Aa, Number T2\<rbrace>, Agent B\<rbrace> \<in> set evs4; \<not> expiredAK Taa evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Taa\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs4 \<longrightarrow> authK \<notin> range shrK \<and> (\<exists>A Peer Ta. Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Ta\<rbrace>\<rbrace> \<in> set evs4) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 6. \<And>evs5 authKa servK Aa authTicketa T2 B Tgs' Ts servTicket. \<lbrakk>evs5 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs5 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs5 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; authKa \<in> symKeys; servK \<in> symKeys; Aa \<noteq> Kas; Aa \<noteq> Tgs; Says Aa Tgs \<lbrace>authTicketa, Crypt authKa \<lbrace>Agent Aa, Number T2\<rbrace>, Agent B\<rbrace> \<in> set evs5; Says Tgs' Aa \<lbrace>Crypt authKa \<lbrace>Key servK, Agent B, Number Ts\<rbrace>, servTicket\<rbrace> \<in> set evs5; valid Ts wrt T2\<rbrakk> \<Longrightarrow> (Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace> = servTicket \<longrightarrow> A = B \<longrightarrow> Kas = Aa \<longrightarrow> authTicket \<noteq> Crypt servK \<lbrace>Agent Kas, Number (CT evs5)\<rbrace>) \<and> (Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs5 \<longrightarrow> authK \<notin> range shrK \<and> (\<exists>A Peer Ta. Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Ta\<rbrace>\<rbrace> \<in> set evs5) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs)
 7. \<And>evs6 B A' Aa servK Ts T3. \<lbrakk>evs6 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs6 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evs6 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; B \<noteq> Kas; B \<noteq> Tgs; Says A' B \<lbrace>Crypt (shrK B) \<lbrace>Agent Aa, Agent B, Key servK, Number Ts\<rbrace>, Crypt servK \<lbrace>Agent Aa, Number T3\<rbrace>\<rbrace> \<in> set evs6; \<not> expiredSK Ts evs6; \<not> expiredA T3 evs6\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evs6 \<longrightarrow> authK \<notin> range shrK \<and> (\<exists>A Peer Ta. Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Ta\<rbrace>\<rbrace> \<in> set evs6) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 8. \<And>evsO1 Aa authKa Taa authTicketa. \<lbrakk>evsO1 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evsO1 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evsO1 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; Aa \<noteq> Spy; Says Kas Aa \<lbrace>Crypt (shrK Aa) \<lbrace>Key authKa, Agent Tgs, Number Taa\<rbrace>, authTicketa\<rbrace> \<in> set evsO1; expiredAK Taa evsO1\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evsO1 \<longrightarrow> authK \<notin> range shrK \<and> (\<exists>A Peer Ta. Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Ta\<rbrace>\<rbrace> \<in> set evsO1) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
 9. \<And>evsO2 Aa authKa servK B Ts servTicket. \<lbrakk>evsO2 \<in> kerbV; Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evsO2 \<longrightarrow> authK \<notin> range shrK \<and> authK \<in> authKeys evsO2 \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs; Aa \<noteq> Spy; Says Tgs Aa \<lbrace>Crypt authKa \<lbrace>Key servK, Agent B, Number Ts\<rbrace>, servTicket\<rbrace> \<in> set evsO2; expiredSK Ts evsO2\<rbrakk> \<Longrightarrow> Says Kas A \<lbrace>Crypt K \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, authTicket\<rbrace> \<in> set evsO2 \<longrightarrow> authK \<notin> range shrK \<and> (\<exists>A Peer Ta. Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Peer, Ta\<rbrace>, Crypt (shrK Peer) \<lbrace>Agent A, Agent Peer, Key authK, Ta\<rbrace>\<rbrace> \<in> set evsO2) \<and> authK \<in> symKeys \<and> authTicket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Ta\<rbrace> \<and> K = shrK A \<and> Peer = Tgs
[PROOF STEP]
apply blast+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma reduction_derivable:
  assumes
    "D + {#L'#} \<in> CC" and
    "- L = L' \<cdot>l \<sigma>" and
    "D \<cdot> \<sigma> \<subseteq># C"
  shows "sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
D + {#L'#} \<in> CC
- L = L' \<cdot>l \<sigma>
D \<cdot> \<sigma> \<subseteq># C
[PROOF STEP]
have "grounding_of_clss (CC \<union> {C}) - grounding_of_clss (CC \<union> {C + {#L#}})
    \<subseteq> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \<union> {C + {#L#}})))"
[PROOF STATE]
proof (prove)
using this:
D + {#L'#} \<in> CC
- L = L' \<cdot>l \<sigma>
D \<cdot> \<sigma> \<subseteq># C

goal (1 subgoal):
 1. grounding_of_clss (CC \<union> {C}) - grounding_of_clss (CC \<union> {C + {#L#}}) \<subseteq> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \<union> {C + {#L#}})))
[PROOF STEP]
using reduction_in_concls_of
[PROOF STATE]
proof (prove)
using this:
D + {#L'#} \<in> CC
- L = L' \<cdot>l \<sigma>
D \<cdot> \<sigma> \<subseteq># C
\<lbrakk>?C\<mu> \<in> grounding_of_cls ?C; ?D + {#?L'#} \<in> ?CC; - ?L = ?L' \<cdot>l ?\<sigma>; ?D \<cdot> ?\<sigma> \<subseteq># ?C\<rbrakk> \<Longrightarrow> ?C\<mu> \<in> concls_of (sr_ext.inferences_from (grounding_of_clss (?CC \<union> {?C + {#?L#}})))

goal (1 subgoal):
 1. grounding_of_clss (CC \<union> {C}) - grounding_of_clss (CC \<union> {C + {#L#}}) \<subseteq> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \<union> {C + {#L#}})))
[PROOF STEP]
unfolding grounding_of_clss_def
[PROOF STATE]
proof (prove)
using this:
D + {#L'#} \<in> CC
- L = L' \<cdot>l \<sigma>
D \<cdot> \<sigma> \<subseteq># C
\<lbrakk>?C\<mu> \<in> grounding_of_cls ?C; ?D + {#?L'#} \<in> ?CC; - ?L = ?L' \<cdot>l ?\<sigma>; ?D \<cdot> ?\<sigma> \<subseteq># ?C\<rbrakk> \<Longrightarrow> ?C\<mu> \<in> concls_of (sr_ext.inferences_from (\<Union> (grounding_of_cls ` (?CC \<union> {?C + {#?L#}}))))

goal (1 subgoal):
 1. \<Union> (grounding_of_cls ` (CC \<union> {C})) - \<Union> (grounding_of_cls ` (CC \<union> {C + {#L#}})) \<subseteq> concls_of (sr_ext.inferences_from (\<Union> (grounding_of_cls ` (CC \<union> {C + {#L#}}))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
grounding_of_clss (CC \<union> {C}) - grounding_of_clss (CC \<union> {C + {#L#}}) \<subseteq> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \<union> {C + {#L#}})))

goal (1 subgoal):
 1. sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
grounding_of_clss (CC \<union> {C}) - grounding_of_clss (CC \<union> {C + {#L#}}) \<subseteq> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \<union> {C + {#L#}})))

goal (1 subgoal):
 1. sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
have "grounding_of_cls (C + {#L#}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. grounding_of_cls (C + {#L#}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
using strict_subset_subsumption_grounding_redundant_clss[of C "id_subst"]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>C \<cdot> id_subst \<subset># ?C; C \<in> ?CC\<rbrakk> \<Longrightarrow> grounding_of_cls ?C \<subseteq> sr.Rf (grounding_of_clss ?CC)

goal (1 subgoal):
 1. grounding_of_cls (C + {#L#}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
grounding_of_cls (C + {#L#}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))

goal (1 subgoal):
 1. sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
grounding_of_cls (C + {#L#}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
have "grounding_of_clss (CC \<union> {C + {#L#}}) - grounding_of_clss (CC \<union> {C})
    \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))"
[PROOF STATE]
proof (prove)
using this:
grounding_of_cls (C + {#L#}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))

goal (1 subgoal):
 1. grounding_of_clss (CC \<union> {C + {#L#}}) - grounding_of_clss (CC \<union> {C}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
unfolding grounding_of_clss_def
[PROOF STATE]
proof (prove)
using this:
grounding_of_cls (C + {#L#}) \<subseteq> sr.Rf (\<Union> (grounding_of_cls ` (CC \<union> {C})))

goal (1 subgoal):
 1. \<Union> (grounding_of_cls ` (CC \<union> {C + {#L#}})) - \<Union> (grounding_of_cls ` (CC \<union> {C})) \<subseteq> sr.Rf (\<Union> (grounding_of_cls ` (CC \<union> {C})))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
grounding_of_clss (CC \<union> {C + {#L#}}) - grounding_of_clss (CC \<union> {C}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))

goal (1 subgoal):
 1. sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
grounding_of_clss (CC \<union> {C}) - grounding_of_clss (CC \<union> {C + {#L#}}) \<subseteq> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \<union> {C + {#L#}})))
grounding_of_clss (CC \<union> {C + {#L#}}) - grounding_of_clss (CC \<union> {C}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
show
    "sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))"
[PROOF STATE]
proof (prove)
using this:
grounding_of_clss (CC \<union> {C}) - grounding_of_clss (CC \<union> {C + {#L#}}) \<subseteq> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \<union> {C + {#L#}})))
grounding_of_clss (CC \<union> {C + {#L#}}) - grounding_of_clss (CC \<union> {C}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))

goal (1 subgoal):
 1. sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
using sr_ext.derive.intros[of "grounding_of_clss (CC \<union> {C})"
        "grounding_of_clss (CC \<union> {C + {#L#}})"]
[PROOF STATE]
proof (prove)
using this:
grounding_of_clss (CC \<union> {C}) - grounding_of_clss (CC \<union> {C + {#L#}}) \<subseteq> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \<union> {C + {#L#}})))
grounding_of_clss (CC \<union> {C + {#L#}}) - grounding_of_clss (CC \<union> {C}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))
\<lbrakk>grounding_of_clss (CC \<union> {C}) - grounding_of_clss (CC \<union> {C + {#L#}}) \<subseteq> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \<union> {C + {#L#}}))); grounding_of_clss (CC \<union> {C + {#L#}}) - grounding_of_clss (CC \<union> {C}) \<subseteq> sr.Rf (grounding_of_clss (CC \<union> {C}))\<rbrakk> \<Longrightarrow> sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))

goal (1 subgoal):
 1. sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
sr_ext.derive (grounding_of_clss (CC \<union> {C + {#L#}})) (grounding_of_clss (CC \<union> {C}))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
theorem
  reads_consistent_flush_all_until_volatile_write:
  "\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts;
  i < length ts; ts!i = (p, is,\<theta>, sb, \<D>, \<O>,\<R>);
  reads_consistent pending_write \<O> m sb \<rbrakk>
  \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>)
  (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
proof (induct ts)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> []; i < length []; [] ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write [] m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
valid_ownership_and_sharing \<S> []
i < length []
[] ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>)
reads_consistent pending_write \<O> m sb

goal (2 subgoals):
 1. \<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> []; i < length []; [] ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write [] m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
valid_ownership_and_sharing \<S> []
i < length []
[] ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>)
reads_consistent pending_write \<O> m sb

goal (1 subgoal):
 1. reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write [] m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write [] m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)

goal (1 subgoal):
 1. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
case (Cons t ts)
[PROOF STATE]
proof (state)
this:
\<lbrakk>valid_ownership_and_sharing \<S> ts; ?i < length ts; ts ! ?i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent ?pending_write \<O> ?m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts ?m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
valid_ownership_and_sharing \<S> (t # ts)
i < length (t # ts)
(t # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>)
reads_consistent pending_write \<O> m sb

goal (1 subgoal):
 1. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
note i_bound = \<open>i < length (t # ts)\<close>
[PROOF STATE]
proof (state)
this:
i < length (t # ts)

goal (1 subgoal):
 1. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
note ts_i = \<open>(t # ts) ! i = (p, is,\<theta>, sb, \<D>, \<O>,\<R>)\<close>
[PROOF STATE]
proof (state)
this:
(t # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>)

goal (1 subgoal):
 1. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
note consis = \<open>reads_consistent pending_write \<O> m sb\<close>
[PROOF STATE]
proof (state)
this:
reads_consistent pending_write \<O> m sb

goal (1 subgoal):
 1. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
note valid = \<open>valid_ownership_and_sharing \<S> (t#ts)\<close>
[PROOF STATE]
proof (state)
this:
valid_ownership_and_sharing \<S> (t # ts)

goal (1 subgoal):
 1. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
valid_ownership_and_sharing \<S> (t # ts)
[PROOF STEP]
interpret valid_ownership_and_sharing \<S> "t#ts"
[PROOF STATE]
proof (prove)
using this:
valid_ownership_and_sharing \<S> (t # ts)

goal (1 subgoal):
 1. valid_ownership_and_sharing \<S> (t # ts)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
from valid_ownership_and_sharing_tl [OF valid]
[PROOF STATE]
proof (chain)
picking this:
valid_ownership_and_sharing \<S> ts
[PROOF STEP]
have valid': "valid_ownership_and_sharing \<S> ts"
[PROOF STATE]
proof (prove)
using this:
valid_ownership_and_sharing \<S> ts

goal (1 subgoal):
 1. valid_ownership_and_sharing \<S> ts
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
valid_ownership_and_sharing \<S> ts

goal (1 subgoal):
 1. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
obtain p\<^sub>t "is\<^sub>t" \<O>\<^sub>t \<R>\<^sub>t \<D>\<^sub>t \<theta>\<^sub>t sb\<^sub>t
    where t: "t=(p\<^sub>t,is\<^sub>t,\<theta>\<^sub>t,sb\<^sub>t,\<D>\<^sub>t,\<O>\<^sub>t,\<R>\<^sub>t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>p\<^sub>t is\<^sub>t \<theta>\<^sub>t sb\<^sub>t \<D>\<^sub>t \<O>\<^sub>t \<R>\<^sub>t. t = (p\<^sub>t, is\<^sub>t, \<theta>\<^sub>t, sb\<^sub>t, \<D>\<^sub>t, \<O>\<^sub>t, \<R>\<^sub>t) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases t)
[PROOF STATE]
proof (state)
this:
t = (p\<^sub>t, is\<^sub>t, \<theta>\<^sub>t, sb\<^sub>t, \<D>\<^sub>t, \<O>\<^sub>t, \<R>\<^sub>t)

goal (1 subgoal):
 1. \<And>a ts i m pending_write. \<lbrakk>\<And>i m pending_write. \<lbrakk>valid_ownership_and_sharing \<S> ts; i < length ts; ts ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); valid_ownership_and_sharing \<S> (a # ts); i < length (a # ts); (a # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>); reads_consistent pending_write \<O> m sb\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (a # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
proof (cases i)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. i = 0 \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
case 0
[PROOF STATE]
proof (state)
this:
i = 0

goal (2 subgoals):
 1. i = 0 \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
with ts_i t
[PROOF STATE]
proof (chain)
picking this:
(t # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>)
t = (p\<^sub>t, is\<^sub>t, \<theta>\<^sub>t, sb\<^sub>t, \<D>\<^sub>t, \<O>\<^sub>t, \<R>\<^sub>t)
i = 0
[PROOF STEP]
have sb_eq: "sb=sb\<^sub>t"
[PROOF STATE]
proof (prove)
using this:
(t # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>)
t = (p\<^sub>t, is\<^sub>t, \<theta>\<^sub>t, sb\<^sub>t, \<D>\<^sub>t, \<O>\<^sub>t, \<R>\<^sub>t)
i = 0

goal (1 subgoal):
 1. sb = sb\<^sub>t
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
sb = sb\<^sub>t

goal (2 subgoals):
 1. i = 0 \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
let ?take_sb = "(takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. i = 0 \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
let ?drop_sb = "(dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. i = 0 \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
from reads_consistent_append [of pending_write \<O> m ?take_sb ?drop_sb] consis
[PROOF STATE]
proof (chain)
picking this:
reads_consistent pending_write \<O> m (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = (reads_consistent pending_write \<O> m (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<and> reads_consistent (pending_write \<or> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {}) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<and> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {} \<longrightarrow> outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {}))
reads_consistent pending_write \<O> m sb
[PROOF STEP]
have consis': "reads_consistent True (acquired True ?take_sb \<O>) (flush ?take_sb m) ?drop_sb"
[PROOF STATE]
proof (prove)
using this:
reads_consistent pending_write \<O> m (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = (reads_consistent pending_write \<O> m (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<and> reads_consistent (pending_write \<or> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {}) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<and> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {} \<longrightarrow> outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {}))
reads_consistent pending_write \<O> m sb

goal (1 subgoal):
 1. reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
apply (cases "outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {}")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>reads_consistent pending_write \<O> m (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = (reads_consistent pending_write \<O> m (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<and> reads_consistent (pending_write \<or> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {}) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<and> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {} \<longrightarrow> outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {})); reads_consistent pending_write \<O> m sb; outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {}\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<lbrakk>reads_consistent pending_write \<O> m (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = (reads_consistent pending_write \<O> m (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<and> reads_consistent (pending_write \<or> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {}) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<and> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {} \<longrightarrow> outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {})); reads_consistent pending_write \<O> m sb; \<not> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {}\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
apply  clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>reads_consistent pending_write \<O> m (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = (reads_consistent pending_write \<O> m (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<and> reads_consistent (pending_write \<or> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {}) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<and> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {} \<longrightarrow> outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {})); reads_consistent pending_write \<O> m sb; \<not> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<noteq> {}\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>reads_consistent pending_write \<O> m sb; outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {}; reads_consistent pending_write \<O> m (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); reads_consistent pending_write (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
apply (simp add: reads_consistent_dropWhile [of pending_write])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)

goal (2 subgoals):
 1. i = 0 \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
from reads_consistent_drop_volatile_writes_no_volatile_reads [OF consis]
[PROOF STATE]
proof (chain)
picking this:
outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {}
[PROOF STEP]
have no_vol_Read\<^sub>s\<^sub>b: "outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {}"
[PROOF STATE]
proof (prove)
using this:
outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {}

goal (1 subgoal):
 1. outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {}
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {}

goal (2 subgoals):
 1. i = 0 \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
hence "outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
           =
           outstanding_refs (\<lambda>s. True) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)"
[PROOF STATE]
proof (prove)
using this:
outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = {}

goal (1 subgoal):
 1. outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = outstanding_refs (\<lambda>s. True) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
by (auto simp add: outstanding_refs_conv)
[PROOF STATE]
proof (state)
this:
outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) = outstanding_refs (\<lambda>s. True) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)

goal (2 subgoals):
 1. i = 0 \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
have "\<forall>i<length ts.
     let (p, is,\<theta>, sb', \<D>, \<O>,\<R>) = ts ! i
     in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter>
        outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}
[PROOF STEP]
fix j p\<^sub>j "is\<^sub>j" \<O>\<^sub>j \<R>\<^sub>j \<D>\<^sub>j \<theta>\<^sub>j sb\<^sub>j x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}
[PROOF STEP]
assume j_bound: "j < length ts"
[PROOF STATE]
proof (state)
this:
j < length ts

goal (1 subgoal):
 1. \<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}
[PROOF STEP]
assume ts_j: "ts!j = (p\<^sub>j,is\<^sub>j,\<theta>\<^sub>j,sb\<^sub>j,\<D>\<^sub>j,\<O>\<^sub>j,\<R>\<^sub>j)"
[PROOF STATE]
proof (state)
this:
ts ! j = (p\<^sub>j, is\<^sub>j, \<theta>\<^sub>j, sb\<^sub>j, \<D>\<^sub>j, \<O>\<^sub>j, \<R>\<^sub>j)

goal (1 subgoal):
 1. \<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}
[PROOF STEP]
assume x_in_sb: "x \<in> outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)"
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)

goal (1 subgoal):
 1. \<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}
[PROOF STEP]
assume x_in_j: "x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)"
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. \<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. False
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. False
[PROOF STEP]
from outstanding_non_volatile_write_not_volatile_read_disj [rule_format, of "Suc j" 0, simplified, OF j_bound ts_j t]
	  sb_eq x_in_sb x_in_j
[PROOF STATE]
proof (chain)
picking this:
outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<inter> outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) = {}
sb = sb\<^sub>t
x \<in> outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<inter> outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) = {}
sb = sb\<^sub>t
x \<in> outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. \<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>?j2 < length ts; ts ! ?j2 = (?p\<^sub>j2, ?is\<^sub>j2, ?\<theta>\<^sub>j2, ?sb\<^sub>j2, ?\<D>\<^sub>j2, ?\<O>\<^sub>j2, ?\<R>\<^sub>j2); ?x2 \<in> outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); ?x2 \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) ?sb\<^sub>j2)\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. \<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?j2 < length ts; ts ! ?j2 = (?p\<^sub>j2, ?is\<^sub>j2, ?\<theta>\<^sub>j2, ?sb\<^sub>j2, ?\<D>\<^sub>j2, ?\<O>\<^sub>j2, ?\<R>\<^sub>j2); ?x2 \<in> outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); ?x2 \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) ?sb\<^sub>j2)\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. \<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}
[PROOF STEP]
by (auto simp add: Let_def)
[PROOF STATE]
proof (state)
this:
\<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>i<length ts. let (p, is, \<theta>, sb', \<D>, \<O>, \<R>) = ts ! i in outstanding_refs (Not \<circ> is_volatile_Read\<^sub>s\<^sub>b) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<inter> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb') = {}

goal (2 subgoals):
 1. i = 0 \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
 2. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
from reads_consistent_flush_all_until_volatile_write_aux [OF no_vol_Read\<^sub>s\<^sub>b consis' this]
[PROOF STATE]
proof (chain)
picking this:
reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m)) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) m)) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)

goal (1 subgoal):
 1. reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
by (simp add: t sb_eq del: o_apply)
[PROOF STATE]
proof (state)
this:
reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)

goal (1 subgoal):
 1. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
case (Suc k)
[PROOF STATE]
proof (state)
this:
i = Suc k

goal (1 subgoal):
 1. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
with i_bound
[PROOF STATE]
proof (chain)
picking this:
i < length (t # ts)
i = Suc k
[PROOF STEP]
have k_bound: "k < length ts"
[PROOF STATE]
proof (prove)
using this:
i < length (t # ts)
i = Suc k

goal (1 subgoal):
 1. k < length ts
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
k < length ts

goal (1 subgoal):
 1. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
from ts_i Suc
[PROOF STATE]
proof (chain)
picking this:
(t # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>)
i = Suc k
[PROOF STEP]
have ts_k: "ts ! k = (p, is,\<theta>, sb, \<D>, \<O>,\<R>)"
[PROOF STATE]
proof (prove)
using this:
(t # ts) ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>)
i = Suc k

goal (1 subgoal):
 1. ts ! k = (p, is, \<theta>, sb, \<D>, \<O>, \<R>)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
ts ! k = (p, is, \<theta>, sb, \<D>, \<O>, \<R>)

goal (1 subgoal):
 1. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
have "reads_consistent False \<O> (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m) sb"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reads_consistent False \<O> (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m) sb
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. reads_consistent False \<O> (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m) sb
[PROOF STEP]
have no_vW:
	"outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) = {}
[PROOF STEP]
apply (clarsimp simp add: outstanding_refs_conv )
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> set (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t); is_volatile_Write\<^sub>s\<^sub>b x\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (drule set_takeWhileD)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>is_volatile_Write\<^sub>s\<^sub>b x; x \<in> set sb\<^sub>t \<and> (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) x\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) = {}

goal (1 subgoal):
 1. reads_consistent False \<O> (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m) sb
[PROOF STEP]
from consis
[PROOF STATE]
proof (chain)
picking this:
reads_consistent pending_write \<O> m sb
[PROOF STEP]
have consis': "reads_consistent False \<O> m sb"
[PROOF STATE]
proof (prove)
using this:
reads_consistent pending_write \<O> m sb

goal (1 subgoal):
 1. reads_consistent False \<O> m sb
[PROOF STEP]
by (cases pending_write) (auto intro: reads_consistent_pending_write_antimono)
[PROOF STATE]
proof (state)
this:
reads_consistent False \<O> m sb

goal (1 subgoal):
 1. reads_consistent False \<O> (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m) sb
[PROOF STEP]
note disj = outstanding_non_volatile_write_disj [where i=0, OF _  i_bound [simplified Suc], simplified, OF t ts_k ]
[PROOF STATE]
proof (state)
this:
outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) - read_only_reads \<O> (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)) \<union> (\<O> \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb))) = {}

goal (1 subgoal):
 1. reads_consistent False \<O> (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m) sb
[PROOF STEP]
from reads_consistent_flush_other' [OF no_vW disj consis' subset_refl]
[PROOF STATE]
proof (chain)
picking this:
reads_consistent False \<O> (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m) sb
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
reads_consistent False \<O> (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m) sb

goal (1 subgoal):
 1. reads_consistent False \<O> (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m) sb
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
reads_consistent False \<O> (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m) sb

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
reads_consistent False \<O> (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m) sb

goal (1 subgoal):
 1. \<And>nat. i = Suc nat \<Longrightarrow> reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
from Cons.hyps [OF valid' k_bound ts_k this]
[PROOF STATE]
proof (chain)
picking this:
reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m)) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write ts (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>t) m)) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)

goal (1 subgoal):
 1. reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
by (simp add: t)
[PROOF STATE]
proof (state)
this:
reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
reads_consistent True (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (flush_all_until_volatile_write (t # ts) m) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)

goal:
No subgoals!
[PROOF STEP]
qed