[STATEMENT]
lemma seq_nhop_quality_increases':
  shows "opaodv i \<Turnstile> (otherwith ((=)) {i}
                        (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)),
                         other quality_increases {i} \<rightarrow>)
                        onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, _). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip)
                                               in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip))
                                                  \<and> nhip \<noteq> dip
                                                  \<longrightarrow> (rt (\<sigma> i)) \<sqsubset>\<^bsub>dip\<^esub> (rt (\<sigma> nhip)))"
  (is "_ \<Turnstile> (?S i, _ \<rightarrow>) _")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
have weaken:
      "\<And>p I Q R P. p \<Turnstile> (otherwith quality_increases I (orecvmsg Q), other quality_increases I \<rightarrow>) P
       \<Longrightarrow> p \<Turnstile> (otherwith ((=)) I (orecvmsg (\<lambda>\<sigma> m. Q \<sigma> m \<and> R \<sigma> m)), other quality_increases I \<rightarrow>) P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>p I Q R P. p \<Turnstile> (otherwith quality_increases I (orecvmsg Q), other quality_increases I \<rightarrow>) P \<Longrightarrow> p \<Turnstile> (otherwith (=) I (orecvmsg (\<lambda>\<sigma> m. Q \<sigma> m \<and> R \<sigma> m)), other quality_increases I \<rightarrow>) P
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?p \<Turnstile> (otherwith quality_increases ?I (orecvmsg ?Q), other quality_increases ?I \<rightarrow>) ?P \<Longrightarrow> ?p \<Turnstile> (otherwith (=) ?I (orecvmsg (\<lambda>\<sigma> m. ?Q \<sigma> m \<and> ?R \<sigma> m)), other quality_increases ?I \<rightarrow>) ?P

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
?p \<Turnstile> (otherwith quality_increases ?I (orecvmsg ?Q), other quality_increases ?I \<rightarrow>) ?P \<Longrightarrow> ?p \<Turnstile> (otherwith (=) ?I (orecvmsg (\<lambda>\<sigma> m. ?Q \<sigma> m \<and> ?R \<sigma> m)), other quality_increases ?I \<rightarrow>) ?P

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
fix i a and \<sigma> \<sigma>' :: "ip \<Rightarrow> state"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
assume a1: "\<forall>dip. dip\<in>vD(rt (\<sigma> i))
                        \<and> dip\<in>vD(rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
                        \<and> (the (nhop (rt (\<sigma> i)) dip)) \<noteq> dip
                         \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))"
         and ow: "?S i \<sigma> \<sigma>' a"
[PROOF STATE]
proof (state)
this:
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) \<sigma> \<sigma>' a

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
have "\<forall>dip. dip\<in>vD(rt (\<sigma> i))
                  \<and> dip\<in>vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
                  \<and> (the (nhop (rt (\<sigma> i)) dip)) \<noteq> dip
               \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
proof clarify
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma> i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))); the (nhop (rt (\<sigma> i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
fix dip
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma> i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))); the (nhop (rt (\<sigma> i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
assume a2: "dip\<in>vD(rt (\<sigma> i))"
           and a3: "dip\<in>vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))"
           and a4: "(the (nhop (rt (\<sigma> i)) dip)) \<noteq> dip"
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> i))
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma> i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))); the (nhop (rt (\<sigma> i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
from ow
[PROOF STATE]
proof (chain)
picking this:
otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) \<sigma> \<sigma>' a
[PROOF STEP]
have "\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j"
[PROOF STATE]
proof (prove)
using this:
otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) \<sigma> \<sigma>' a

goal (1 subgoal):
 1. \<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma> i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))); the (nhop (rt (\<sigma> i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
show "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
proof (cases "(the (nhop (rt (\<sigma> i)) dip)) = i")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. the (nhop (rt (\<sigma> i)) dip) = i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
 2. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
assume "(the (nhop (rt (\<sigma> i)) dip)) = i"
[PROOF STATE]
proof (state)
this:
the (nhop (rt (\<sigma> i)) dip) = i

goal (2 subgoals):
 1. the (nhop (rt (\<sigma> i)) dip) = i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
 2. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
with \<open>dip \<in> vD(rt (\<sigma> i))\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma> i))
the (nhop (rt (\<sigma> i)) dip) = i
[PROOF STEP]
have "dip \<in> vD(rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma> i))
the (nhop (rt (\<sigma> i)) dip) = i

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (2 subgoals):
 1. the (nhop (rt (\<sigma> i)) dip) = i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
 2. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
with a1 a2 a4
[PROOF STATE]
proof (chain)
picking this:
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
dip \<in> vD (rt (\<sigma> i))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
have "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))"
[PROOF STATE]
proof (prove)
using this:
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
dip \<in> vD (rt (\<sigma> i))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (2 subgoals):
 1. the (nhop (rt (\<sigma> i)) dip) = i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
 2. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
with \<open>(the (nhop (rt (\<sigma> i)) dip)) = i\<close>
[PROOF STATE]
proof (chain)
picking this:
the (nhop (rt (\<sigma> i)) dip) = i
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
have "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> i)"
[PROOF STATE]
proof (prove)
using this:
the (nhop (rt (\<sigma> i)) dip) = i
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> i)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> i)

goal (2 subgoals):
 1. the (nhop (rt (\<sigma> i)) dip) = i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
 2. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
hence False
[PROOF STATE]
proof (prove)
using this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> i)

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
False

goal (2 subgoals):
 1. the (nhop (rt (\<sigma> i)) dip) = i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
 2. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
assume "(the (nhop (rt (\<sigma> i)) dip)) \<noteq> i"
[PROOF STATE]
proof (state)
this:
the (nhop (rt (\<sigma> i)) dip) \<noteq> i

goal (1 subgoal):
 1. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
with \<open>\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j\<close>
[PROOF STATE]
proof (chain)
picking this:
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
the (nhop (rt (\<sigma> i)) dip) \<noteq> i
[PROOF STEP]
have *: "\<sigma> (the (nhop (rt (\<sigma> i)) dip)) = \<sigma>' (the (nhop (rt (\<sigma> i)) dip))"
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
the (nhop (rt (\<sigma> i)) dip) \<noteq> i

goal (1 subgoal):
 1. \<sigma> (the (nhop (rt (\<sigma> i)) dip)) = \<sigma>' (the (nhop (rt (\<sigma> i)) dip))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<sigma> (the (nhop (rt (\<sigma> i)) dip)) = \<sigma>' (the (nhop (rt (\<sigma> i)) dip))

goal (1 subgoal):
 1. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
with \<open>dip\<in>vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
\<sigma> (the (nhop (rt (\<sigma> i)) dip)) = \<sigma>' (the (nhop (rt (\<sigma> i)) dip))
[PROOF STEP]
have "dip\<in>vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
\<sigma> (the (nhop (rt (\<sigma> i)) dip)) = \<sigma>' (the (nhop (rt (\<sigma> i)) dip))

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
with a1 a2 a4
[PROOF STATE]
proof (chain)
picking this:
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
dip \<in> vD (rt (\<sigma> i))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
have "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))"
[PROOF STATE]
proof (prove)
using this:
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
dip \<in> vD (rt (\<sigma> i))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. the (nhop (rt (\<sigma> i)) dip) \<noteq> i \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
with *
[PROOF STATE]
proof (chain)
picking this:
\<sigma> (the (nhop (rt (\<sigma> i)) dip)) = \<sigma>' (the (nhop (rt (\<sigma> i)) dip))
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<sigma> (the (nhop (rt (\<sigma> i)) dip)) = \<sigma>' (the (nhop (rt (\<sigma> i)) dip))
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>dip. dip \<in> vD (rt (?\<sigma>3 ?ia3)) \<and> dip \<in> vD (rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))) \<and> the (nhop (rt (?\<sigma>3 ?ia3)) dip) \<noteq> dip \<longrightarrow> rt (?\<sigma>3 ?ia3) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip))); otherwith (=) {?ia3} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) ?\<sigma>3 ?\<sigma>'3 ?a3\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (?\<sigma>3 ?ia3)) \<and> dip \<in> vD (rt (?\<sigma>'3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))) \<and> the (nhop (rt (?\<sigma>3 ?ia3)) dip) \<noteq> dip \<longrightarrow> rt (?\<sigma>3 ?ia3) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>'3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
note basic = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>dip. dip \<in> vD (rt (?\<sigma>3 ?ia3)) \<and> dip \<in> vD (rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))) \<and> the (nhop (rt (?\<sigma>3 ?ia3)) dip) \<noteq> dip \<longrightarrow> rt (?\<sigma>3 ?ia3) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip))); otherwith (=) {?ia3} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) ?\<sigma>3 ?\<sigma>'3 ?a3\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (?\<sigma>3 ?ia3)) \<and> dip \<in> vD (rt (?\<sigma>'3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))) \<and> the (nhop (rt (?\<sigma>3 ?ia3)) dip) \<noteq> dip \<longrightarrow> rt (?\<sigma>3 ?ia3) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>'3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>dip. dip \<in> vD (rt (?\<sigma>3 ?ia3)) \<and> dip \<in> vD (rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))) \<and> the (nhop (rt (?\<sigma>3 ?ia3)) dip) \<noteq> dip \<longrightarrow> rt (?\<sigma>3 ?ia3) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip))); otherwith (=) {?ia3} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) ?\<sigma>3 ?\<sigma>'3 ?a3\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (?\<sigma>3 ?ia3)) \<and> dip \<in> vD (rt (?\<sigma>'3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))) \<and> the (nhop (rt (?\<sigma>3 ?ia3)) dip) \<noteq> dip \<longrightarrow> rt (?\<sigma>3 ?ia3) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>'3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
fix \<sigma> \<sigma>' a dip sip i
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
assume a1: "\<forall>dip. dip\<in>vD(rt (\<sigma> i))
                      \<and> dip\<in>vD(rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
                      \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
                      \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))"
         and ow: "?S i \<sigma> \<sigma>' a"
[PROOF STATE]
proof (state)
this:
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) \<sigma> \<sigma>' a

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
have "\<forall>dip. dip\<in>vD(update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}))
           \<and> dip\<in>vD(rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip))))
           \<and> the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip
           \<longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})
               \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>dip. dip \<in> vD (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))) \<and> the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip \<longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
proof clarify
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})); dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))); the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
fix dip
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})); dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))); the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
assume a2: "dip\<in>vD (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}))"
           and a3: "dip\<in>vD(rt (\<sigma>' (the (nhop
                         (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip))))"
           and a4: "the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip"
[PROOF STATE]
proof (state)
this:
dip \<in> vD (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}))
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip))))
the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})); dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))); the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
show "update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})
              \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
proof (cases "dip = sip")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. dip = sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
 2. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
assume "dip = sip"
[PROOF STATE]
proof (state)
this:
dip = sip

goal (2 subgoals):
 1. dip = sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
 2. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
with \<open>the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip\<close>
[PROOF STATE]
proof (chain)
picking this:
the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip
dip = sip
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip
dip = sip

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
False

goal (2 subgoals):
 1. dip = sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
 2. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))

goal (1 subgoal):
 1. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
assume [simp]: "dip \<noteq> sip"
[PROOF STATE]
proof (state)
this:
dip \<noteq> sip

goal (1 subgoal):
 1. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
from a2
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}))
[PROOF STEP]
have "dip\<in>vD(rt (\<sigma> i)) \<or> dip = sip"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}))

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma> i)) \<or> dip = sip
[PROOF STEP]
by (rule vD_update_val)
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> i)) \<or> dip = sip

goal (1 subgoal):
 1. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
with \<open>dip \<noteq> sip\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<noteq> sip
dip \<in> vD (rt (\<sigma> i)) \<or> dip = sip
[PROOF STEP]
have "dip\<in>vD(rt (\<sigma> i))"
[PROOF STATE]
proof (prove)
using this:
dip \<noteq> sip
dip \<in> vD (rt (\<sigma> i)) \<or> dip = sip

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma> i))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> i))

goal (1 subgoal):
 1. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> i))

goal (1 subgoal):
 1. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
from a3
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip))))
[PROOF STEP]
have "dip\<in>vD(rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip))))

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
from a4
[PROOF STATE]
proof (chain)
picking this:
the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip
[PROOF STEP]
have "the (nhop (rt (\<sigma> i)) dip) \<noteq> dip"
[PROOF STATE]
proof (prove)
using this:
the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip

goal (1 subgoal):
 1. the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip

goal (1 subgoal):
 1. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma> i))
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
[PROOF STEP]
have "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma> i))
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
using a1 ow
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma> i))
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) \<sigma> \<sigma>' a

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
by - (drule(1) basic, simp)
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. dip \<noteq> sip \<Longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
with \<open>dip \<noteq> sip\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<noteq> sip
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
dip \<noteq> sip
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))
[PROOF STEP]
by - (erule rt_strictly_fresher_update_other, simp)
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>dip. dip \<in> vD (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))) \<and> the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip) \<noteq> dip \<longrightarrow> update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) sip (0, unk, val, Suc 0, sip, {})) dip)))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>dip. dip \<in> vD (rt (?\<sigma>3 ?ia3)) \<and> dip \<in> vD (rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))) \<and> the (nhop (rt (?\<sigma>3 ?ia3)) dip) \<noteq> dip \<longrightarrow> rt (?\<sigma>3 ?ia3) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip))); otherwith (=) {?ia3} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) ?\<sigma>3 ?\<sigma>'3 ?a3\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) \<and> dip \<in> vD (rt (?\<sigma>'3 (the (nhop (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) dip)))) \<and> the (nhop (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) dip) \<noteq> dip \<longrightarrow> update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>'3 (the (nhop (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) dip)))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
note update_0_unk = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>dip. dip \<in> vD (rt (?\<sigma>3 ?ia3)) \<and> dip \<in> vD (rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))) \<and> the (nhop (rt (?\<sigma>3 ?ia3)) dip) \<noteq> dip \<longrightarrow> rt (?\<sigma>3 ?ia3) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip))); otherwith (=) {?ia3} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) ?\<sigma>3 ?\<sigma>'3 ?a3\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) \<and> dip \<in> vD (rt (?\<sigma>'3 (the (nhop (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) dip)))) \<and> the (nhop (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) dip) \<noteq> dip \<longrightarrow> update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>'3 (the (nhop (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) dip)))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>dip. dip \<in> vD (rt (?\<sigma>3 ?ia3)) \<and> dip \<in> vD (rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))) \<and> the (nhop (rt (?\<sigma>3 ?ia3)) dip) \<noteq> dip \<longrightarrow> rt (?\<sigma>3 ?ia3) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip))); otherwith (=) {?ia3} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) ?\<sigma>3 ?\<sigma>'3 ?a3\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) \<and> dip \<in> vD (rt (?\<sigma>'3 (the (nhop (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) dip)))) \<and> the (nhop (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) dip) \<noteq> dip \<longrightarrow> update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>'3 (the (nhop (update (rt (?\<sigma>3 ?ia3)) ?sip3 (0, unk, val, Suc 0, ?sip3, {})) dip)))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
fix \<sigma> a \<sigma>' nhop
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
assume pre: "\<forall>dip. dip\<in>vD(rt (\<sigma> i)) \<and> dip\<in>vD(rt (\<sigma> (nhop dip))) \<and> nhop dip \<noteq> dip
                         \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (nhop dip))"
         and ow: "?S i \<sigma> \<sigma>' a"
[PROOF STATE]
proof (state)
this:
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (nhop dip))) \<and> nhop dip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (nhop dip))
otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) \<sigma> \<sigma>' a

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
have "\<forall>dip. dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i)))
                  \<and> dip \<in> vD (rt (\<sigma>' (nhop dip))) \<and> nhop dip \<noteq> dip
                  \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>dip. dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i))) \<and> dip \<in> vD (rt (\<sigma>' (nhop dip))) \<and> nhop dip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))
[PROOF STEP]
proof clarify
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i))); dip \<in> vD (rt (\<sigma>' (nhop dip))); nhop dip \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))
[PROOF STEP]
fix dip
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i))); dip \<in> vD (rt (\<sigma>' (nhop dip))); nhop dip \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))
[PROOF STEP]
assume "dip\<in>vD(invalidate (rt (\<sigma> i)) (dests (\<sigma> i)))"
           and "dip\<in>vD(rt (\<sigma>' (nhop dip)))"
           and "nhop dip \<noteq> dip"
[PROOF STATE]
proof (state)
this:
dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i)))
dip \<in> vD (rt (\<sigma>' (nhop dip)))
nhop dip \<noteq> dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i))); dip \<in> vD (rt (\<sigma>' (nhop dip))); nhop dip \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))
[PROOF STEP]
from this(1)
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i)))
[PROOF STEP]
have "dip\<in>vD (rt (\<sigma> i))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i)))

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma> i))
[PROOF STEP]
by (clarsimp dest!: vD_invalidate_vD_not_dests)
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> i))

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i))); dip \<in> vD (rt (\<sigma>' (nhop dip))); nhop dip \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> i))

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i))); dip \<in> vD (rt (\<sigma>' (nhop dip))); nhop dip \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))
[PROOF STEP]
from ow
[PROOF STATE]
proof (chain)
picking this:
otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) \<sigma> \<sigma>' a
[PROOF STEP]
have "\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j"
[PROOF STATE]
proof (prove)
using this:
otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) \<sigma> \<sigma>' a

goal (1 subgoal):
 1. \<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i))); dip \<in> vD (rt (\<sigma>' (nhop dip))); nhop dip \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma> i))
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
[PROOF STEP]
have "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (nhop dip))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma> i))
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (nhop dip))
[PROOF STEP]
using pre \<open>dip \<in> vD (rt (\<sigma>' (nhop dip)))\<close> \<open>nhop dip \<noteq> dip\<close>
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma> i))
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (nhop dip))) \<and> nhop dip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (nhop dip))
dip \<in> vD (rt (\<sigma>' (nhop dip)))
nhop dip \<noteq> dip

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (nhop dip))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (nhop dip))

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i))); dip \<in> vD (rt (\<sigma>' (nhop dip))); nhop dip \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))
[PROOF STEP]
with \<open>\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j\<close>
[PROOF STATE]
proof (chain)
picking this:
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (nhop dip))
[PROOF STEP]
show  "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))"
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (nhop dip))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))
[PROOF STEP]
by (metis rt_strictly_fresher_irefl)
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>dip. dip \<in> vD (invalidate (rt (\<sigma> i)) (dests (\<sigma> i))) \<and> dip \<in> vD (rt (\<sigma>' (nhop dip))) \<and> nhop dip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (nhop dip))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>dip. dip \<in> vD (rt (?\<sigma>3 i)) \<and> dip \<in> vD (rt (?\<sigma>3 (?nhop3 dip))) \<and> ?nhop3 dip \<noteq> dip \<longrightarrow> rt (?\<sigma>3 i) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>3 (?nhop3 dip)); otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) ?\<sigma>3 ?\<sigma>'3 ?a3\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (invalidate (rt (?\<sigma>3 i)) (dests (?\<sigma>3 i))) \<and> dip \<in> vD (rt (?\<sigma>'3 (?nhop3 dip))) \<and> ?nhop3 dip \<noteq> dip \<longrightarrow> rt (?\<sigma>3 i) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>'3 (?nhop3 dip))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
note invalidate = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>dip. dip \<in> vD (rt (?\<sigma>3 i)) \<and> dip \<in> vD (rt (?\<sigma>3 (?nhop3 dip))) \<and> ?nhop3 dip \<noteq> dip \<longrightarrow> rt (?\<sigma>3 i) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>3 (?nhop3 dip)); otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) ?\<sigma>3 ?\<sigma>'3 ?a3\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (invalidate (rt (?\<sigma>3 i)) (dests (?\<sigma>3 i))) \<and> dip \<in> vD (rt (?\<sigma>'3 (?nhop3 dip))) \<and> ?nhop3 dip \<noteq> dip \<longrightarrow> rt (?\<sigma>3 i) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>'3 (?nhop3 dip))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>dip. dip \<in> vD (rt (?\<sigma>3 i)) \<and> dip \<in> vD (rt (?\<sigma>3 (?nhop3 dip))) \<and> ?nhop3 dip \<noteq> dip \<longrightarrow> rt (?\<sigma>3 i) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>3 (?nhop3 dip)); otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) ?\<sigma>3 ?\<sigma>'3 ?a3\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (invalidate (rt (?\<sigma>3 i)) (dests (?\<sigma>3 i))) \<and> dip \<in> vD (rt (?\<sigma>'3 (?nhop3 dip))) \<and> ?nhop3 dip \<noteq> dip \<longrightarrow> rt (?\<sigma>3 i) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>'3 (?nhop3 dip))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
fix \<sigma> a \<sigma>' dip oip osn sip hops i
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
assume pre: "\<forall>dip. dip \<in> vD (rt (\<sigma> i))
                       \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
                       \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
                   \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))"
         and ow: "?S i \<sigma> \<sigma>' a"
         and "Suc 0 \<le> osn"
         and a6: "sip \<noteq> oip \<longrightarrow> oip \<in> kD (rt (\<sigma> sip))
                                 \<and> osn \<le> nsqn (rt (\<sigma> sip)) oip
                                 \<and> (nsqn (rt (\<sigma> sip)) oip = osn
                                    \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops
                                         \<or> the (flag (rt (\<sigma> sip)) oip) = inv)"
         and after: "\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>"
[PROOF STATE]
proof (state)
this:
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) \<sigma> \<sigma>' a
Suc 0 \<le> osn
sip \<noteq> oip \<longrightarrow> oip \<in> kD (rt (\<sigma> sip)) \<and> osn \<le> nsqn (rt (\<sigma> sip)) oip \<and> (nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops \<or> the (flag (rt (\<sigma> sip)) oip) = Aodv_Basic.inv)
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
have "\<forall>dip. dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
                \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip
                                      (osn, kno, val, Suc hops, sip, {})) dip))))
                \<and> the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip
             \<longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})
                 \<sqsubset>\<^bsub>dip\<^esub>
                 rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>dip. dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) \<and> the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip \<longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
proof clarify
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})); dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))); the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
fix dip
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})); dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))); the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
assume a2: "dip\<in>vD(update (rt (\<sigma> i)) oip (osn, kno, val, Suc (hops), sip, {}))"
           and a3: "dip\<in>vD(rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip
                                                        (osn, kno, val, Suc hops, sip, {})) dip))))"
           and a4: "the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip"
[PROOF STATE]
proof (state)
this:
dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})); dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))); the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from ow
[PROOF STATE]
proof (chain)
picking this:
otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) \<sigma> \<sigma>' a
[PROOF STEP]
have a5: "\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j"
[PROOF STATE]
proof (prove)
using this:
otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) \<sigma> \<sigma>' a

goal (1 subgoal):
 1. \<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})); dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))); the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
show "update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})
              \<sqsubset>\<^bsub>dip\<^esub>
              rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))"
          (is "?rt1 \<sqsubset>\<^bsub>dip\<^esub> ?rt2 dip")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
proof (cases "?rt1 = rt (\<sigma> i)")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
assume nochange [simp]:
            "update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i)"
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i)

goal (2 subgoals):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from after
[PROOF STATE]
proof (chain)
picking this:
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
[PROOF STEP]
have "\<sigma>' i = \<sigma> i"
[PROOF STATE]
proof (prove)
using this:
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>

goal (1 subgoal):
 1. \<sigma>' i = \<sigma> i
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<sigma>' i = \<sigma> i

goal (2 subgoals):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
with a5
[PROOF STATE]
proof (chain)
picking this:
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
\<sigma>' i = \<sigma> i
[PROOF STEP]
have "\<forall>j. \<sigma> j = \<sigma>' j"
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
\<sigma>' i = \<sigma> i

goal (1 subgoal):
 1. \<forall>j. \<sigma> j = \<sigma>' j
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
\<forall>j. \<sigma> j = \<sigma>' j

goal (2 subgoals):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from a2
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
[PROOF STEP]
have "dip\<in>vD (rt (\<sigma> i))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma> i))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> i))

goal (2 subgoals):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> i))

goal (2 subgoals):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from a3
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
[PROOF STEP]
have "dip\<in>vD(rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
using nochange and \<open>\<forall>j. \<sigma> j = \<sigma>' j\<close>
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i)
\<forall>j. \<sigma> j = \<sigma>' j

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
by clarsimp
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (2 subgoals):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (2 subgoals):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from a4
[PROOF STATE]
proof (chain)
picking this:
the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip
[PROOF STEP]
have "the (nhop (rt (\<sigma> i)) dip) \<noteq> dip"
[PROOF STATE]
proof (prove)
using this:
the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip

goal (1 subgoal):
 1. the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip

goal (2 subgoals):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma> i))
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
[PROOF STEP]
have "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma> i))
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
using pre
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma> i))
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (2 subgoals):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
hence "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))"
[PROOF STATE]
proof (prove)
using this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
using \<open>\<forall>j. \<sigma> j = \<sigma>' j\<close>
[PROOF STATE]
proof (prove)
using this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
\<forall>j. \<sigma> j = \<sigma>' j

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (2 subgoals):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
thus "?thesis"
[PROOF STATE]
proof (prove)
using this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))

goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
assume change: "?rt1 \<noteq> rt (\<sigma> i)"
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)

goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from after a2
[PROOF STATE]
proof (chain)
picking this:
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
[PROOF STEP]
have "dip\<in>kD(rt (\<sigma>' i))"
[PROOF STATE]
proof (prove)
using this:
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))

goal (1 subgoal):
 1. dip \<in> kD (rt (\<sigma>' i))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dip \<in> kD (rt (\<sigma>' i))

goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i) \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
proof (cases "dip = oip")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. dip \<noteq> oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
assume "dip \<noteq> oip"
[PROOF STATE]
proof (state)
this:
dip \<noteq> oip

goal (2 subgoals):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. dip \<noteq> oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
with a2
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
dip \<noteq> oip
[PROOF STEP]
have "dip\<in>vD (rt (\<sigma> i))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
dip \<noteq> oip

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma> i))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> i))

goal (2 subgoals):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. dip \<noteq> oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> i))

goal (2 subgoals):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. dip \<noteq> oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
with a3 a5 after and \<open>dip \<noteq> oip\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
dip \<noteq> oip
dip \<in> vD (rt (\<sigma> i))
[PROOF STEP]
have "dip\<in>vD(rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
dip \<noteq> oip
dip \<in> vD (rt (\<sigma> i))

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
by simp metis
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (2 subgoals):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. dip \<noteq> oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (2 subgoals):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. dip \<noteq> oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from a4 and \<open>dip \<noteq> oip\<close>
[PROOF STATE]
proof (chain)
picking this:
the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip
dip \<noteq> oip
[PROOF STEP]
have "the (nhop (rt (\<sigma> i)) dip) \<noteq> dip"
[PROOF STATE]
proof (prove)
using this:
the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip
dip \<noteq> oip

goal (1 subgoal):
 1. the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip

goal (2 subgoals):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. dip \<noteq> oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma> i))
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
[PROOF STEP]
have "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma> i))
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
using pre
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma> i))
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (2 subgoals):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. dip \<noteq> oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
with after and a5 and \<open>dip \<noteq> oip\<close>
[PROOF STATE]
proof (chain)
picking this:
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
dip \<noteq> oip
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
dip \<noteq> oip
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
by simp (metis rt_strictly_fresher_update_other
                             rt_strictly_fresher_irefl)
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))

goal (1 subgoal):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
assume "dip = oip"
[PROOF STATE]
proof (state)
this:
dip = oip

goal (1 subgoal):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
with a4 and change
[PROOF STATE]
proof (chain)
picking this:
the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
dip = oip
[PROOF STEP]
have "sip \<noteq> oip"
[PROOF STATE]
proof (prove)
using this:
the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
dip = oip

goal (1 subgoal):
 1. sip \<noteq> oip
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
sip \<noteq> oip

goal (1 subgoal):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
with a6
[PROOF STATE]
proof (chain)
picking this:
sip \<noteq> oip \<longrightarrow> oip \<in> kD (rt (\<sigma> sip)) \<and> osn \<le> nsqn (rt (\<sigma> sip)) oip \<and> (nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops \<or> the (flag (rt (\<sigma> sip)) oip) = Aodv_Basic.inv)
sip \<noteq> oip
[PROOF STEP]
have "oip\<in>kD(rt (\<sigma> sip))"
                     and "osn \<le> nsqn (rt (\<sigma> sip)) oip"
[PROOF STATE]
proof (prove)
using this:
sip \<noteq> oip \<longrightarrow> oip \<in> kD (rt (\<sigma> sip)) \<and> osn \<le> nsqn (rt (\<sigma> sip)) oip \<and> (nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops \<or> the (flag (rt (\<sigma> sip)) oip) = Aodv_Basic.inv)
sip \<noteq> oip

goal (1 subgoal):
 1. oip \<in> kD (rt (\<sigma> sip)) &&& osn \<le> nsqn (rt (\<sigma> sip)) oip
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
oip \<in> kD (rt (\<sigma> sip))
osn \<le> nsqn (rt (\<sigma> sip)) oip

goal (1 subgoal):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from a3 change \<open>dip = oip\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
dip = oip
[PROOF STEP]
have "oip\<in>vD(rt (\<sigma>' sip))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
dip = oip

goal (1 subgoal):
 1. oip \<in> vD (rt (\<sigma>' sip))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
oip \<in> vD (rt (\<sigma>' sip))

goal (1 subgoal):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
hence "the (flag (rt (\<sigma>' sip)) oip) = val"
[PROOF STATE]
proof (prove)
using this:
oip \<in> vD (rt (\<sigma>' sip))

goal (1 subgoal):
 1. the (flag (rt (\<sigma>' sip)) oip) = val
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
the (flag (rt (\<sigma>' sip)) oip) = val

goal (1 subgoal):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from \<open>oip\<in>kD(rt (\<sigma> sip))\<close>
[PROOF STATE]
proof (chain)
picking this:
oip \<in> kD (rt (\<sigma> sip))
[PROOF STEP]
have "osn < nsqn (rt (\<sigma>' sip)) oip \<or> (osn = nsqn (rt (\<sigma>' sip)) oip
                                                   \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops)"
[PROOF STATE]
proof (prove)
using this:
oip \<in> kD (rt (\<sigma> sip))

goal (1 subgoal):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. oip \<in> vD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
 2. oip \<in> iD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
assume "oip\<in>vD(rt (\<sigma> sip))"
[PROOF STATE]
proof (state)
this:
oip \<in> vD (rt (\<sigma> sip))

goal (2 subgoals):
 1. oip \<in> vD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
 2. oip \<in> iD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
hence "the (flag (rt (\<sigma> sip)) oip) = val"
[PROOF STATE]
proof (prove)
using this:
oip \<in> vD (rt (\<sigma> sip))

goal (1 subgoal):
 1. the (flag (rt (\<sigma> sip)) oip) = val
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
the (flag (rt (\<sigma> sip)) oip) = val

goal (2 subgoals):
 1. oip \<in> vD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
 2. oip \<in> iD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
with a6 \<open>sip \<noteq> oip\<close>
[PROOF STATE]
proof (chain)
picking this:
sip \<noteq> oip \<longrightarrow> oip \<in> kD (rt (\<sigma> sip)) \<and> osn \<le> nsqn (rt (\<sigma> sip)) oip \<and> (nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops \<or> the (flag (rt (\<sigma> sip)) oip) = Aodv_Basic.inv)
sip \<noteq> oip
the (flag (rt (\<sigma> sip)) oip) = val
[PROOF STEP]
have "nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow>
                                          the (dhops (rt (\<sigma> sip)) oip) \<le> hops"
[PROOF STATE]
proof (prove)
using this:
sip \<noteq> oip \<longrightarrow> oip \<in> kD (rt (\<sigma> sip)) \<and> osn \<le> nsqn (rt (\<sigma> sip)) oip \<and> (nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops \<or> the (flag (rt (\<sigma> sip)) oip) = Aodv_Basic.inv)
sip \<noteq> oip
the (flag (rt (\<sigma> sip)) oip) = val

goal (1 subgoal):
 1. nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops

goal (2 subgoals):
 1. oip \<in> vD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
 2. oip \<in> iD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
proof (cases "sip = i")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. sip = i \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
 2. sip \<noteq> i \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
assume "sip \<noteq> i"
[PROOF STATE]
proof (state)
this:
sip \<noteq> i

goal (2 subgoals):
 1. sip = i \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
 2. sip \<noteq> i \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
with a5
[PROOF STATE]
proof (chain)
picking this:
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
sip \<noteq> i
[PROOF STEP]
have "\<sigma> sip = \<sigma>' sip"
[PROOF STATE]
proof (prove)
using this:
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
sip \<noteq> i

goal (1 subgoal):
 1. \<sigma> sip = \<sigma>' sip
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<sigma> sip = \<sigma>' sip

goal (2 subgoals):
 1. sip = i \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
 2. sip \<noteq> i \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
with \<open>osn \<le> nsqn (rt (\<sigma> sip)) oip\<close>
                 and \<open>nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops\<close>
[PROOF STATE]
proof (chain)
picking this:
osn \<le> nsqn (rt (\<sigma> sip)) oip
nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops
\<sigma> sip = \<sigma>' sip
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
osn \<le> nsqn (rt (\<sigma> sip)) oip
nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops
\<sigma> sip = \<sigma>' sip

goal (1 subgoal):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops

goal (1 subgoal):
 1. sip = i \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
next
                \<comment> \<open>alternative to using @{text sip_not_ip}\<close>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. sip = i \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
assume [simp]: "sip = i"
[PROOF STATE]
proof (state)
this:
sip = i

goal (1 subgoal):
 1. sip = i \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
have "?rt1 = rt (\<sigma> i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i)
[PROOF STEP]
proof (rule update_cases_kD, simp_all)
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. 0 < osn
 2. oip \<in> kD (rt (\<sigma> i))
 3. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 5. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 6. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
from \<open>Suc 0 \<le> osn\<close>
[PROOF STATE]
proof (chain)
picking this:
Suc 0 \<le> osn
[PROOF STEP]
show "0 < osn"
[PROOF STATE]
proof (prove)
using this:
Suc 0 \<le> osn

goal (1 subgoal):
 1. 0 < osn
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
0 < osn

goal (5 subgoals):
 1. oip \<in> kD (rt (\<sigma> i))
 2. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 5. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. oip \<in> kD (rt (\<sigma> i))
 2. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 5. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
from \<open>oip\<in>kD(rt (\<sigma> sip))\<close> and \<open>sip = i\<close>
[PROOF STATE]
proof (chain)
picking this:
oip \<in> kD (rt (\<sigma> sip))
sip = i
[PROOF STEP]
show "oip\<in>kD(rt (\<sigma> i))"
[PROOF STATE]
proof (prove)
using this:
oip \<in> kD (rt (\<sigma> sip))
sip = i

goal (1 subgoal):
 1. oip \<in> kD (rt (\<sigma> i))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
oip \<in> kD (rt (\<sigma> i))

goal (4 subgoals):
 1. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
assume "sqn (rt (\<sigma> i)) oip < osn"
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma> i)) oip < osn

goal (4 subgoals):
 1. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma> i)) oip < osn

goal (4 subgoals):
 1. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
from \<open>osn \<le> nsqn (rt (\<sigma> sip)) oip\<close>
[PROOF STATE]
proof (chain)
picking this:
osn \<le> nsqn (rt (\<sigma> sip)) oip
[PROOF STEP]
have "... \<le> nsqn (rt (\<sigma> i)) oip"
[PROOF STATE]
proof (prove)
using this:
osn \<le> nsqn (rt (\<sigma> sip)) oip

goal (1 subgoal):
 1. osn \<le> nsqn (rt (\<sigma> i)) oip
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
osn \<le> nsqn (rt (\<sigma> i)) oip

goal (4 subgoals):
 1. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
osn \<le> nsqn (rt (\<sigma> i)) oip

goal (4 subgoals):
 1. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
have "... \<le> sqn (rt (\<sigma> i)) oip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nsqn (rt (\<sigma> i)) oip \<le> sqn (rt (\<sigma> i)) oip
[PROOF STEP]
by (rule nsqn_sqn)
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> i)) oip \<le> sqn (rt (\<sigma> i)) oip

goal (4 subgoals):
 1. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
sqn (rt (\<sigma> i)) oip < sqn (rt (\<sigma> i)) oip
[PROOF STEP]
have "sqn (rt (\<sigma> i)) oip < sqn (rt (\<sigma> i)) oip"
[PROOF STATE]
proof (prove)
using this:
sqn (rt (\<sigma> i)) oip < sqn (rt (\<sigma> i)) oip

goal (1 subgoal):
 1. sqn (rt (\<sigma> i)) oip < sqn (rt (\<sigma> i)) oip
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma> i)) oip < sqn (rt (\<sigma> i)) oip

goal (4 subgoals):
 1. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
hence False
[PROOF STATE]
proof (prove)
using this:
sqn (rt (\<sigma> i)) oip < sqn (rt (\<sigma> i)) oip

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
False

goal (4 subgoals):
 1. sqn (rt (\<sigma> i)) oip < osn \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 4. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
thus "(\<lambda>a. if a = oip
                             then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip)))
                             else rt (\<sigma> i) a) = rt (\<sigma> i)"
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)

goal (3 subgoals):
 1. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
assume "sqn (rt (\<sigma> i)) oip = osn"
                     and "Suc hops < the (dhops (rt (\<sigma> i)) oip)"
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma> i)) oip = osn
Suc hops < the (dhops (rt (\<sigma> i)) oip)

goal (3 subgoals):
 1. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
from this(1) and \<open>oip \<in> vD (rt (\<sigma> sip))\<close>
[PROOF STATE]
proof (chain)
picking this:
sqn (rt (\<sigma> i)) oip = osn
oip \<in> vD (rt (\<sigma> sip))
[PROOF STEP]
have "nsqn (rt (\<sigma> i)) oip = osn"
[PROOF STATE]
proof (prove)
using this:
sqn (rt (\<sigma> i)) oip = osn
oip \<in> vD (rt (\<sigma> sip))

goal (1 subgoal):
 1. nsqn (rt (\<sigma> i)) oip = osn
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> i)) oip = osn

goal (3 subgoals):
 1. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
with \<open>nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops\<close>
[PROOF STATE]
proof (chain)
picking this:
nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops
nsqn (rt (\<sigma> i)) oip = osn
[PROOF STEP]
have "the (dhops (rt (\<sigma> i)) oip) \<le> hops"
[PROOF STATE]
proof (prove)
using this:
nsqn (rt (\<sigma> sip)) oip = osn \<longrightarrow> the (dhops (rt (\<sigma> sip)) oip) \<le> hops
nsqn (rt (\<sigma> i)) oip = osn

goal (1 subgoal):
 1. the (dhops (rt (\<sigma> i)) oip) \<le> hops
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
the (dhops (rt (\<sigma> i)) oip) \<le> hops

goal (3 subgoals):
 1. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
with \<open>Suc hops < the (dhops (rt (\<sigma> i)) oip)\<close>
[PROOF STATE]
proof (chain)
picking this:
Suc hops < the (dhops (rt (\<sigma> i)) oip)
the (dhops (rt (\<sigma> i)) oip) \<le> hops
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
Suc hops < the (dhops (rt (\<sigma> i)) oip)
the (dhops (rt (\<sigma> i)) oip) \<le> hops

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
False

goal (3 subgoals):
 1. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; Suc hops < the (dhops (rt (\<sigma> i)) oip)\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 3. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
thus "(\<lambda>a. if a = oip
                             then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip)))
                             else rt (\<sigma> i) a) = rt (\<sigma> i)"
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)

goal (2 subgoals):
 1. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
assume "the (flag (rt (\<sigma> i)) oip) = inv"
[PROOF STATE]
proof (state)
this:
the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv

goal (2 subgoals):
 1. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
with \<open>the (flag (rt (\<sigma> sip)) oip) = val\<close>
[PROOF STATE]
proof (chain)
picking this:
the (flag (rt (\<sigma> sip)) oip) = val
the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
the (flag (rt (\<sigma> sip)) oip) = val
the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
False

goal (2 subgoals):
 1. \<lbrakk>sqn (rt (\<sigma> i)) oip = osn; the (flag (rt (\<sigma> i)) oip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
 2. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
thus "(\<lambda>a. if a = oip
                             then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip)))
                             else rt (\<sigma> i) a) = rt (\<sigma> i)"
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. (\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<lambda>a. if a = oip then Some (osn, kno, val, Suc hops, i, \<pi>\<^sub>7 (the (rt (\<sigma> i) oip))) else rt (\<sigma> i) a) = rt (\<sigma> i)

goal (1 subgoal):
 1. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>osn \<le> sqn (rt (\<sigma> i)) oip; sqn (rt (\<sigma> i)) oip = osn \<Longrightarrow> the (dhops (rt (\<sigma> i)) oip) \<le> Suc hops \<and> the (flag (rt (\<sigma> i)) oip) = val\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
from \<open>oip\<in>kD(rt (\<sigma> sip))\<close>
[PROOF STATE]
proof (chain)
picking this:
oip \<in> kD (rt (\<sigma> sip))
[PROOF STEP]
show "(\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)"
[PROOF STATE]
proof (prove)
using this:
oip \<in> kD (rt (\<sigma> sip))

goal (1 subgoal):
 1. (\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)
[PROOF STEP]
by (auto dest!: kD_Some)
[PROOF STATE]
proof (state)
this:
(\<lambda>a. if a = oip then Some (the (rt (\<sigma> i) oip)) else rt (\<sigma> i) a) = rt (\<sigma> i)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i)

goal (1 subgoal):
 1. sip = i \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
with change
[PROOF STATE]
proof (chain)
picking this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i)
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) = rt (\<sigma> i)

goal (1 subgoal):
 1. False
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. sip = i \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops

goal (1 subgoal):
 1. oip \<in> iD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. oip \<in> iD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
assume "oip\<in>iD(rt (\<sigma> sip))"
[PROOF STATE]
proof (state)
this:
oip \<in> iD (rt (\<sigma> sip))

goal (1 subgoal):
 1. oip \<in> iD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
with \<open>the (flag (rt (\<sigma>' sip)) oip) = val\<close> and a5
[PROOF STATE]
proof (chain)
picking this:
the (flag (rt (\<sigma>' sip)) oip) = val
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
oip \<in> iD (rt (\<sigma> sip))
[PROOF STEP]
have "sip = i"
[PROOF STATE]
proof (prove)
using this:
the (flag (rt (\<sigma>' sip)) oip) = val
\<forall>j. j \<noteq> i \<longrightarrow> \<sigma> j = \<sigma>' j
oip \<in> iD (rt (\<sigma> sip))

goal (1 subgoal):
 1. sip = i
[PROOF STEP]
by (metis f.distinct(1) iD_flag_is_inv)
[PROOF STATE]
proof (state)
this:
sip = i

goal (1 subgoal):
 1. oip \<in> iD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
from \<open>oip\<in>iD(rt (\<sigma> sip))\<close>
[PROOF STATE]
proof (chain)
picking this:
oip \<in> iD (rt (\<sigma> sip))
[PROOF STEP]
have "the (flag (rt (\<sigma> sip)) oip) = inv"
[PROOF STATE]
proof (prove)
using this:
oip \<in> iD (rt (\<sigma> sip))

goal (1 subgoal):
 1. the (flag (rt (\<sigma> sip)) oip) = Aodv_Basic.inv
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
the (flag (rt (\<sigma> sip)) oip) = Aodv_Basic.inv

goal (1 subgoal):
 1. oip \<in> iD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
with \<open>sip = i\<close> \<open>Suc 0 \<le> osn\<close> change after \<open>oip\<in>kD(rt (\<sigma> sip))\<close>
[PROOF STATE]
proof (chain)
picking this:
sip = i
Suc 0 \<le> osn
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
oip \<in> kD (rt (\<sigma> sip))
the (flag (rt (\<sigma> sip)) oip) = Aodv_Basic.inv
[PROOF STEP]
have "nsqn (rt (\<sigma> sip)) oip < nsqn (rt (\<sigma>' sip)) oip"
[PROOF STATE]
proof (prove)
using this:
sip = i
Suc 0 \<le> osn
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
oip \<in> kD (rt (\<sigma> sip))
the (flag (rt (\<sigma> sip)) oip) = Aodv_Basic.inv

goal (1 subgoal):
 1. nsqn (rt (\<sigma> sip)) oip < nsqn (rt (\<sigma>' sip)) oip
[PROOF STEP]
unfolding update_def
[PROOF STATE]
proof (prove)
using this:
sip = i
Suc 0 \<le> osn
(case rt (\<sigma> i) oip of None \<Rightarrow> rt (\<sigma> i)(oip \<mapsto> (osn, kno, val, Suc hops, sip, {})) | Some s \<Rightarrow> if \<pi>\<^sub>2 s < \<pi>\<^sub>2 (osn, kno, val, Suc hops, sip, {}) then rt (\<sigma> i)(oip \<mapsto> addpre (osn, kno, val, Suc hops, sip, {}) (\<pi>\<^sub>7 s)) else if \<pi>\<^sub>2 s = \<pi>\<^sub>2 (osn, kno, val, Suc hops, sip, {}) \<and> (\<pi>\<^sub>5 (osn, kno, val, Suc hops, sip, {}) < \<pi>\<^sub>5 s \<or> \<pi>\<^sub>4 s = Aodv_Basic.inv) then rt (\<sigma> i)(oip \<mapsto> addpre (osn, kno, val, Suc hops, sip, {}) (\<pi>\<^sub>7 s)) else if \<pi>\<^sub>3 (osn, kno, val, Suc hops, sip, {}) = unk then rt (\<sigma> i)(oip \<mapsto> (\<pi>\<^sub>2 s, snd (addpre (osn, kno, val, Suc hops, sip, {}) (\<pi>\<^sub>7 s)))) else rt (\<sigma> i)(oip \<mapsto> addpre s (\<pi>\<^sub>7 (osn, kno, val, Suc hops, sip, {})))) \<noteq> rt (\<sigma> i)
\<sigma>' i = \<sigma> i\<lparr>rt := case rt (\<sigma> i) oip of None \<Rightarrow> rt (\<sigma> i)(oip \<mapsto> (osn, kno, val, Suc hops, sip, {})) | Some s \<Rightarrow> if \<pi>\<^sub>2 s < \<pi>\<^sub>2 (osn, kno, val, Suc hops, sip, {}) then rt (\<sigma> i)(oip \<mapsto> addpre (osn, kno, val, Suc hops, sip, {}) (\<pi>\<^sub>7 s)) else if \<pi>\<^sub>2 s = \<pi>\<^sub>2 (osn, kno, val, Suc hops, sip, {}) \<and> (\<pi>\<^sub>5 (osn, kno, val, Suc hops, sip, {}) < \<pi>\<^sub>5 s \<or> \<pi>\<^sub>4 s = Aodv_Basic.inv) then rt (\<sigma> i)(oip \<mapsto> addpre (osn, kno, val, Suc hops, sip, {}) (\<pi>\<^sub>7 s)) else if \<pi>\<^sub>3 (osn, kno, val, Suc hops, sip, {}) = unk then rt (\<sigma> i)(oip \<mapsto> (\<pi>\<^sub>2 s, snd (addpre (osn, kno, val, Suc hops, sip, {}) (\<pi>\<^sub>7 s)))) else rt (\<sigma> i)(oip \<mapsto> addpre s (\<pi>\<^sub>7 (osn, kno, val, Suc hops, sip, {})))\<rparr>
oip \<in> kD (rt (\<sigma> sip))
the (flag (rt (\<sigma> sip)) oip) = Aodv_Basic.inv

goal (1 subgoal):
 1. nsqn (rt (\<sigma> sip)) oip < nsqn (rt (\<sigma>' sip)) oip
[PROOF STEP]
by (clarsimp split: option.split_asm if_split_asm)
                     (auto simp: sqn_def)
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> sip)) oip < nsqn (rt (\<sigma>' sip)) oip

goal (1 subgoal):
 1. oip \<in> iD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
with \<open>osn \<le> nsqn (rt (\<sigma> sip)) oip\<close>
[PROOF STATE]
proof (chain)
picking this:
osn \<le> nsqn (rt (\<sigma> sip)) oip
nsqn (rt (\<sigma> sip)) oip < nsqn (rt (\<sigma>' sip)) oip
[PROOF STEP]
have "osn < nsqn (rt (\<sigma>' sip)) oip"
[PROOF STATE]
proof (prove)
using this:
osn \<le> nsqn (rt (\<sigma> sip)) oip
nsqn (rt (\<sigma> sip)) oip < nsqn (rt (\<sigma>' sip)) oip

goal (1 subgoal):
 1. osn < nsqn (rt (\<sigma>' sip)) oip
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
osn < nsqn (rt (\<sigma>' sip)) oip

goal (1 subgoal):
 1. oip \<in> iD (rt (\<sigma> sip)) \<Longrightarrow> osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
osn < nsqn (rt (\<sigma>' sip)) oip

goal (1 subgoal):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops

goal (1 subgoal):
 1. dip = oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
osn < nsqn (rt (\<sigma>' sip)) oip \<or> osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops

goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
assume osnlt: "osn < nsqn (rt (\<sigma>' sip)) oip"
[PROOF STATE]
proof (state)
this:
osn < nsqn (rt (\<sigma>' sip)) oip

goal (2 subgoals):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from \<open>dip\<in>kD(rt (\<sigma>' i))\<close> and \<open>dip = oip\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<in> kD (rt (\<sigma>' i))
dip = oip
[PROOF STEP]
have "dip \<in> kD (?rt1)"
[PROOF STATE]
proof (prove)
using this:
dip \<in> kD (rt (\<sigma>' i))
dip = oip

goal (1 subgoal):
 1. dip \<in> kD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dip \<in> kD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))

goal (2 subgoals):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dip \<in> kD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))

goal (2 subgoals):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from a3
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
[PROOF STEP]
have "dip \<in> kD(?rt2 dip)"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))

goal (1 subgoal):
 1. dip \<in> kD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dip \<in> kD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))

goal (2 subgoals):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
dip \<in> kD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))

goal (2 subgoals):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
have "nsqn ?rt1 dip < nsqn (?rt2 dip) dip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip
[PROOF STEP]
have "nsqn ?rt1 oip = osn"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = osn
[PROOF STEP]
by (simp add: \<open>dip = oip\<close> nsqn_update_changed_kno_val [OF change [THEN not_sym]])
[PROOF STATE]
proof (state)
this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = osn

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = osn

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip
[PROOF STEP]
have "... < nsqn (rt (\<sigma>' sip)) oip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. osn < nsqn (rt (\<sigma>' sip)) oip
[PROOF STEP]
using osnlt
[PROOF STATE]
proof (prove)
using this:
osn < nsqn (rt (\<sigma>' sip)) oip

goal (1 subgoal):
 1. osn < nsqn (rt (\<sigma>' sip)) oip
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
osn < nsqn (rt (\<sigma>' sip)) oip

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
osn < nsqn (rt (\<sigma>' sip)) oip

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip
[PROOF STEP]
have  "... = nsqn (?rt2 oip) oip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nsqn (rt (\<sigma>' sip)) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
by (simp add: change)
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma>' sip)) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip
[PROOF STEP]
using \<open>dip = oip\<close>
[PROOF STATE]
proof (prove)
using this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
dip = oip

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip

goal (2 subgoals):
 1. osn < nsqn (rt (\<sigma>' sip)) oip \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
 2. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
dip \<in> kD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
dip \<in> kD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
dip \<in> kD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
dip \<in> kD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip < nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) dip

goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
by (rule rt_strictly_fresher_ltI)
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))

goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
assume osneq: "osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops"
[PROOF STATE]
proof (state)
this:
osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops

goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
have "oip\<in>kD(?rt1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. oip \<in> kD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
oip \<in> kD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))

goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
oip \<in> kD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))

goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
from a3 \<open>dip = oip\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
dip = oip
[PROOF STEP]
have "oip\<in>kD(?rt2 oip)"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip))))
dip = oip

goal (1 subgoal):
 1. oip \<in> kD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
oip \<in> kD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))))

goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
oip \<in> kD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))))

goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
have "nsqn ?rt1 oip = nsqn (?rt2 oip) oip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
from osneq
[PROOF STATE]
proof (chain)
picking this:
osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
have "osn = nsqn (rt (\<sigma>' sip)) oip"
[PROOF STATE]
proof (prove)
using this:
osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops

goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
osn = nsqn (rt (\<sigma>' sip)) oip

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
osn = nsqn (rt (\<sigma>' sip)) oip

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
have "osn = nsqn ?rt1 oip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. osn = nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip
[PROOF STEP]
by (simp add: \<open>dip = oip\<close> nsqn_update_changed_kno_val [OF change [THEN not_sym]])
[PROOF STATE]
proof (state)
this:
osn = nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
osn = nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
have  "nsqn (rt (\<sigma>' sip)) oip = nsqn (?rt2 oip) oip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nsqn (rt (\<sigma>' sip)) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
by (simp add: change)
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma>' sip)) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip

goal (1 subgoal):
 1. nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip

goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip

goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
have "\<pi>\<^sub>5(the (?rt2 oip oip)) < \<pi>\<^sub>5(the (?rt1 oip))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))
[PROOF STEP]
from osneq
[PROOF STATE]
proof (chain)
picking this:
osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
have "the (dhops (rt (\<sigma>' sip)) oip) \<le> hops"
[PROOF STATE]
proof (prove)
using this:
osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops

goal (1 subgoal):
 1. the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
the (dhops (rt (\<sigma>' sip)) oip) \<le> hops

goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
the (dhops (rt (\<sigma>' sip)) oip) \<le> hops

goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))
[PROOF STEP]
from \<open>oip \<in> vD (rt (\<sigma>' sip))\<close>
[PROOF STATE]
proof (chain)
picking this:
oip \<in> vD (rt (\<sigma>' sip))
[PROOF STEP]
have "oip\<in>kD(rt (\<sigma>' sip))"
[PROOF STATE]
proof (prove)
using this:
oip \<in> vD (rt (\<sigma>' sip))

goal (1 subgoal):
 1. oip \<in> kD (rt (\<sigma>' sip))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
oip \<in> kD (rt (\<sigma>' sip))

goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
oip \<in> kD (rt (\<sigma>' sip))
[PROOF STEP]
have "\<pi>\<^sub>5(the (rt (\<sigma>' sip) oip)) \<le> hops"
[PROOF STATE]
proof (prove)
using this:
the (dhops (rt (\<sigma>' sip)) oip) \<le> hops
oip \<in> kD (rt (\<sigma>' sip))

goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' sip) oip)) \<le> hops
[PROOF STEP]
by (auto simp add: proj5_eq_dhops)
[PROOF STATE]
proof (state)
this:
\<pi>\<^sub>5 (the (rt (\<sigma>' sip) oip)) \<le> hops

goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<pi>\<^sub>5 (the (rt (\<sigma>' sip) oip)) \<le> hops

goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))
[PROOF STEP]
from change after
[PROOF STATE]
proof (chain)
picking this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
[PROOF STEP]
have "hops < \<pi>\<^sub>5(the (rt (\<sigma>' i) oip))"
[PROOF STATE]
proof (prove)
using this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>

goal (1 subgoal):
 1. hops < \<pi>\<^sub>5 (the (rt (\<sigma>' i) oip))
[PROOF STEP]
by (simp add: proj5_eq_dhops) (metis dhops_update_changed lessI)
[PROOF STATE]
proof (state)
this:
hops < \<pi>\<^sub>5 (the (rt (\<sigma>' i) oip))

goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
\<pi>\<^sub>5 (the (rt (\<sigma>' sip) oip)) < \<pi>\<^sub>5 (the (rt (\<sigma>' i) oip))
[PROOF STEP]
have "\<pi>\<^sub>5(the (rt (\<sigma>' sip) oip)) < \<pi>\<^sub>5(the (rt (\<sigma>' i) oip))"
[PROOF STATE]
proof (prove)
using this:
\<pi>\<^sub>5 (the (rt (\<sigma>' sip) oip)) < \<pi>\<^sub>5 (the (rt (\<sigma>' i) oip))

goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' sip) oip)) < \<pi>\<^sub>5 (the (rt (\<sigma>' i) oip))
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
\<pi>\<^sub>5 (the (rt (\<sigma>' sip) oip)) < \<pi>\<^sub>5 (the (rt (\<sigma>' i) oip))

goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))
[PROOF STEP]
with change after
[PROOF STATE]
proof (chain)
picking this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
\<pi>\<^sub>5 (the (rt (\<sigma>' sip) oip)) < \<pi>\<^sub>5 (the (rt (\<sigma>' i) oip))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<noteq> rt (\<sigma> i)
\<sigma>' i = \<sigma> i\<lparr>rt := update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})\<rparr>
\<pi>\<^sub>5 (the (rt (\<sigma>' sip) oip)) < \<pi>\<^sub>5 (the (rt (\<sigma>' i) oip))

goal (1 subgoal):
 1. \<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))

goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
oip \<in> kD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
oip \<in> kD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))))
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
\<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))
[PROOF STEP]
have "?rt1 \<sqsubset>\<^bsub>oip\<^esub> ?rt2 oip"
[PROOF STATE]
proof (prove)
using this:
oip \<in> kD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}))
oip \<in> kD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))))
nsqn (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip = nsqn (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))) oip
\<pi>\<^sub>5 (the (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip))) oip)) < \<pi>\<^sub>5 (the (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) oip))

goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>oip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))
[PROOF STEP]
by (rule rt_strictly_fresher_eqI)
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>oip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))

goal (1 subgoal):
 1. osn = nsqn (rt (\<sigma>' sip)) oip \<and> the (dhops (rt (\<sigma>' sip)) oip) \<le> hops \<Longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
with \<open>dip = oip\<close>
[PROOF STATE]
proof (chain)
picking this:
dip = oip
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>oip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
dip = oip
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>oip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) oip)))

goal (1 subgoal):
 1. update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>dip. dip \<in> vD (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))) \<and> the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip) \<noteq> dip \<longrightarrow> update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (update (rt (\<sigma> i)) oip (osn, kno, val, Suc hops, sip, {})) dip)))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>dip. dip \<in> vD (rt (?\<sigma>3 ?ia3)) \<and> dip \<in> vD (rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))) \<and> the (nhop (rt (?\<sigma>3 ?ia3)) dip) \<noteq> dip \<longrightarrow> rt (?\<sigma>3 ?ia3) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip))); otherwith (=) {?ia3} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) ?\<sigma>3 ?\<sigma>'3 ?a3; Suc 0 \<le> ?osn3; ?sip3 \<noteq> ?oip3 \<longrightarrow> ?oip3 \<in> kD (rt (?\<sigma>3 ?sip3)) \<and> ?osn3 \<le> nsqn (rt (?\<sigma>3 ?sip3)) ?oip3 \<and> (nsqn (rt (?\<sigma>3 ?sip3)) ?oip3 = ?osn3 \<longrightarrow> the (dhops (rt (?\<sigma>3 ?sip3)) ?oip3) \<le> ?hops3 \<or> the (flag (rt (?\<sigma>3 ?sip3)) ?oip3) = Aodv_Basic.inv); ?\<sigma>'3 ?ia3 = ?\<sigma>3 ?ia3\<lparr>rt := update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {})\<rparr>\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {})) \<and> dip \<in> vD (rt (?\<sigma>'3 (the (nhop (update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {})) dip)))) \<and> the (nhop (update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {})) dip) \<noteq> dip \<longrightarrow> update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>'3 (the (nhop (update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {})) dip)))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
note rreq_rrep_update = this
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>dip. dip \<in> vD (rt (?\<sigma>3 ?ia3)) \<and> dip \<in> vD (rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip)))) \<and> the (nhop (rt (?\<sigma>3 ?ia3)) dip) \<noteq> dip \<longrightarrow> rt (?\<sigma>3 ?ia3) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>3 (the (nhop (rt (?\<sigma>3 ?ia3)) dip))); otherwith (=) {?ia3} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)) ?\<sigma>3 ?\<sigma>'3 ?a3; Suc 0 \<le> ?osn3; ?sip3 \<noteq> ?oip3 \<longrightarrow> ?oip3 \<in> kD (rt (?\<sigma>3 ?sip3)) \<and> ?osn3 \<le> nsqn (rt (?\<sigma>3 ?sip3)) ?oip3 \<and> (nsqn (rt (?\<sigma>3 ?sip3)) ?oip3 = ?osn3 \<longrightarrow> the (dhops (rt (?\<sigma>3 ?sip3)) ?oip3) \<le> ?hops3 \<or> the (flag (rt (?\<sigma>3 ?sip3)) ?oip3) = Aodv_Basic.inv); ?\<sigma>'3 ?ia3 = ?\<sigma>3 ?ia3\<lparr>rt := update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {})\<rparr>\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {})) \<and> dip \<in> vD (rt (?\<sigma>'3 (the (nhop (update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {})) dip)))) \<and> the (nhop (update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {})) dip) \<noteq> dip \<longrightarrow> update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {}) \<sqsubset>\<^bsub>dip\<^esub> rt (?\<sigma>'3 (the (nhop (update (rt (?\<sigma>3 ?ia3)) ?oip3 (?osn3, kno, val, Suc ?hops3, ?sip3, {})) dip)))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
have "opaodv i \<Turnstile> (otherwith ((=)) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m
                                                            \<and> msg_zhops m)),
                       other quality_increases {i} \<rightarrow>)
            onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V
           (\<lambda>(\<sigma>, _). \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
                           \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
                           \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
proof (inv_cterms inv add: onl_oinvariant_sterms [OF aodv_wf rreq_sip [THEN weaken]]
                                 onl_oinvariant_sterms [OF aodv_wf rrep_sip [THEN weaken]]
                                 onl_oinvariant_sterms [OF aodv_wf rerr_sip [THEN weaken]]
                                 onl_oinvariant_sterms [OF aodv_wf oosn_rreq [THEN weaken]]
                                 onl_oinvariant_sterms [OF aodv_wf odsn_rrep [THEN weaken]]
                                 onl_oinvariant_sterms [OF aodv_wf oaddpreRT_welldefined]
                        solve: basic update_0_unk invalidate rreq_rrep_update
                        simp add: seqlsimp)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<sigma> \<sigma>' p l. \<lbrakk>(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i}); l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p; \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))); other quality_increases {i} \<sigma> \<sigma>'\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (\<sigma>' i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))) \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
fix \<sigma> \<sigma>' p l
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<sigma> \<sigma>' p l. \<lbrakk>(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i}); l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p; \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))); other quality_increases {i} \<sigma> \<sigma>'\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (\<sigma>' i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))) \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
assume or: "(\<sigma>, p) \<in> oreachable (opaodv i) (?S i)  (other quality_increases {i})"
           and "other quality_increases {i} \<sigma> \<sigma>'"
           and ll: "l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p"
           and pre: "\<forall>dip. dip\<in>vD (rt (\<sigma> i))
                           \<and> dip\<in>vD(rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
                           \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
                        \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))"
[PROOF STATE]
proof (state)
this:
(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i})
other quality_increases {i} \<sigma> \<sigma>'
l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. \<And>\<sigma> \<sigma>' p l. \<lbrakk>(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i}); l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p; \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))); other quality_increases {i} \<sigma> \<sigma>'\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (\<sigma>' i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))) \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
from this(1-2)
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i})
other quality_increases {i} \<sigma> \<sigma>'
[PROOF STEP]
have or': "(\<sigma>', p) \<in> oreachable (opaodv i) (?S i)  (other quality_increases {i})"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i})
other quality_increases {i} \<sigma> \<sigma>'

goal (1 subgoal):
 1. (\<sigma>', p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i})
[PROOF STEP]
by - (rule oreachable_other')
[PROOF STATE]
proof (state)
this:
(\<sigma>', p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i})

goal (1 subgoal):
 1. \<And>\<sigma> \<sigma>' p l. \<lbrakk>(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i}); l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p; \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))); other quality_increases {i} \<sigma> \<sigma>'\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (\<sigma>' i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))) \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
from or and ll
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i})
l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p
[PROOF STEP]
have next_hop: "\<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip)
                                             in dip \<in> kD(rt (\<sigma> i)) \<and> nhip \<noteq> dip
                                             \<longrightarrow> dip \<in> kD(rt (\<sigma> nhip))
                                                 \<and> nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> nhip)) dip"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i})
l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p

goal (1 subgoal):
 1. \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> kD (rt (\<sigma> i)) \<and> nhip \<noteq> dip \<longrightarrow> dip \<in> kD (rt (\<sigma> nhip)) \<and> nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> nhip)) dip
[PROOF STEP]
by (auto dest!: onl_oinvariant_weakenD [OF seq_compare_next_hop'])
[PROOF STATE]
proof (state)
this:
\<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> kD (rt (\<sigma> i)) \<and> nhip \<noteq> dip \<longrightarrow> dip \<in> kD (rt (\<sigma> nhip)) \<and> nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> nhip)) dip

goal (1 subgoal):
 1. \<And>\<sigma> \<sigma>' p l. \<lbrakk>(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i}); l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p; \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))); other quality_increases {i} \<sigma> \<sigma>'\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (\<sigma>' i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))) \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
from or and ll
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i})
l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p
[PROOF STEP]
have unk_hops_one: "\<forall>dip\<in>kD (rt (\<sigma> i)). sqn (rt (\<sigma> i)) dip = 0
                                                \<longrightarrow> sqnf (rt (\<sigma> i)) dip = unk
                                                    \<and> the (dhops (rt (\<sigma> i)) dip) = 1
                                                    \<and> the (nhop (rt (\<sigma> i)) dip) = dip"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i})
l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p

goal (1 subgoal):
 1. \<forall>dip\<in>kD (rt (\<sigma> i)). sqn (rt (\<sigma> i)) dip = 0 \<longrightarrow> sqnf (rt (\<sigma> i)) dip = unk \<and> the (dhops (rt (\<sigma> i)) dip) = 1 \<and> the (nhop (rt (\<sigma> i)) dip) = dip
[PROOF STEP]
by (auto dest!: onl_oinvariant_weakenD [OF ozero_seq_unk_hops_one
                                                     [OF oaodv_trans aodv_trans]]
                          otherwith_actionD
                          simp: seqlsimp)
[PROOF STATE]
proof (state)
this:
\<forall>dip\<in>kD (rt (\<sigma> i)). sqn (rt (\<sigma> i)) dip = 0 \<longrightarrow> sqnf (rt (\<sigma> i)) dip = unk \<and> the (dhops (rt (\<sigma> i)) dip) = 1 \<and> the (nhop (rt (\<sigma> i)) dip) = dip

goal (1 subgoal):
 1. \<And>\<sigma> \<sigma>' p l. \<lbrakk>(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i}); l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p; \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))); other quality_increases {i} \<sigma> \<sigma>'\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (\<sigma>' i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))) \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
from \<open>other quality_increases {i} \<sigma> \<sigma>'\<close>
[PROOF STATE]
proof (chain)
picking this:
other quality_increases {i} \<sigma> \<sigma>'
[PROOF STEP]
have "\<sigma>' i = \<sigma> i"
[PROOF STATE]
proof (prove)
using this:
other quality_increases {i} \<sigma> \<sigma>'

goal (1 subgoal):
 1. \<sigma>' i = \<sigma> i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<sigma>' i = \<sigma> i

goal (1 subgoal):
 1. \<And>\<sigma> \<sigma>' p l. \<lbrakk>(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i}); l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p; \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))); other quality_increases {i} \<sigma> \<sigma>'\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (\<sigma>' i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))) \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
hence "quality_increases (\<sigma> i) (\<sigma>' i)"
[PROOF STATE]
proof (prove)
using this:
\<sigma>' i = \<sigma> i

goal (1 subgoal):
 1. quality_increases (\<sigma> i) (\<sigma>' i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
quality_increases (\<sigma> i) (\<sigma>' i)

goal (1 subgoal):
 1. \<And>\<sigma> \<sigma>' p l. \<lbrakk>(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i}); l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p; \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))); other quality_increases {i} \<sigma> \<sigma>'\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (\<sigma>' i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))) \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
with \<open>other quality_increases {i} \<sigma> \<sigma>'\<close>
[PROOF STATE]
proof (chain)
picking this:
other quality_increases {i} \<sigma> \<sigma>'
quality_increases (\<sigma> i) (\<sigma>' i)
[PROOF STEP]
have "\<forall>j. quality_increases (\<sigma> j) (\<sigma>' j)"
[PROOF STATE]
proof (prove)
using this:
other quality_increases {i} \<sigma> \<sigma>'
quality_increases (\<sigma> i) (\<sigma>' i)

goal (1 subgoal):
 1. \<forall>j. quality_increases (\<sigma> j) (\<sigma>' j)
[PROOF STEP]
by - (erule otherE, metis singleton_iff)
[PROOF STATE]
proof (state)
this:
\<forall>j. quality_increases (\<sigma> j) (\<sigma>' j)

goal (1 subgoal):
 1. \<And>\<sigma> \<sigma>' p l. \<lbrakk>(\<sigma>, p) \<in> oreachable (opaodv i) (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m))) (other quality_increases {i}); l \<in> labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p; \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))); other quality_increases {i} \<sigma> \<sigma>'\<rbrakk> \<Longrightarrow> \<forall>dip. dip \<in> vD (rt (\<sigma>' i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))) \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
show "\<forall>dip. dip \<in> vD (rt (\<sigma>' i))
                  \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip))))
                  \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip
              \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>dip. dip \<in> vD (rt (\<sigma>' i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))) \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
proof clarify
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
fix dip
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
assume "dip\<in>vD(rt (\<sigma>' i))"
             and "dip\<in>vD(rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip))))"
             and "the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip"
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma>' i))
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip))))
the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
from this(1) and \<open>\<sigma>' i = \<sigma> i\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma>' i))
\<sigma>' i = \<sigma> i
[PROOF STEP]
have "dip\<in>vD(rt (\<sigma> i))"
                                         and "dip\<in>kD(rt (\<sigma> i))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma>' i))
\<sigma>' i = \<sigma> i

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma> i)) &&& dip \<in> kD (rt (\<sigma> i))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> i))
dip \<in> kD (rt (\<sigma> i))

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
from \<open>the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<close> and \<open>\<sigma>' i = \<sigma> i\<close>
[PROOF STATE]
proof (chain)
picking this:
the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip
\<sigma>' i = \<sigma> i
[PROOF STEP]
have "the (nhop (rt (\<sigma> i)) dip) \<noteq> dip" (is "?nhip \<noteq> _")
[PROOF STATE]
proof (prove)
using this:
the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip
\<sigma>' i = \<sigma> i

goal (1 subgoal):
 1. the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
with \<open>dip\<in>kD(rt (\<sigma> i))\<close> and next_hop
[PROOF STATE]
proof (chain)
picking this:
dip \<in> kD (rt (\<sigma> i))
\<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> kD (rt (\<sigma> i)) \<and> nhip \<noteq> dip \<longrightarrow> dip \<in> kD (rt (\<sigma> nhip)) \<and> nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> nhip)) dip
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
[PROOF STEP]
have "dip\<in>kD(rt (\<sigma> (?nhip)))"
             and nsqns: "nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> ?nhip)) dip"
[PROOF STATE]
proof (prove)
using this:
dip \<in> kD (rt (\<sigma> i))
\<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> kD (rt (\<sigma> i)) \<and> nhip \<noteq> dip \<longrightarrow> dip \<in> kD (rt (\<sigma> nhip)) \<and> nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> nhip)) dip
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip

goal (1 subgoal):
 1. dip \<in> kD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) &&& nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
by (auto simp: Let_def)
[PROOF STATE]
proof (state)
this:
dip \<in> kD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
have "0 < sqn (rt (\<sigma> i)) dip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < sqn (rt (\<sigma> i)) dip
[PROOF STEP]
proof (rule neq0_conv [THEN iffD1, OF notI])
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. sqn (rt (\<sigma> i)) dip = 0 \<Longrightarrow> False
[PROOF STEP]
assume "sqn (rt (\<sigma> i)) dip = 0"
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma> i)) dip = 0

goal (1 subgoal):
 1. sqn (rt (\<sigma> i)) dip = 0 \<Longrightarrow> False
[PROOF STEP]
with \<open>dip\<in>kD(rt (\<sigma> i))\<close> and unk_hops_one
[PROOF STATE]
proof (chain)
picking this:
dip \<in> kD (rt (\<sigma> i))
\<forall>dip\<in>kD (rt (\<sigma> i)). sqn (rt (\<sigma> i)) dip = 0 \<longrightarrow> sqnf (rt (\<sigma> i)) dip = unk \<and> the (dhops (rt (\<sigma> i)) dip) = 1 \<and> the (nhop (rt (\<sigma> i)) dip) = dip
sqn (rt (\<sigma> i)) dip = 0
[PROOF STEP]
have "?nhip = dip"
[PROOF STATE]
proof (prove)
using this:
dip \<in> kD (rt (\<sigma> i))
\<forall>dip\<in>kD (rt (\<sigma> i)). sqn (rt (\<sigma> i)) dip = 0 \<longrightarrow> sqnf (rt (\<sigma> i)) dip = unk \<and> the (dhops (rt (\<sigma> i)) dip) = 1 \<and> the (nhop (rt (\<sigma> i)) dip) = dip
sqn (rt (\<sigma> i)) dip = 0

goal (1 subgoal):
 1. the (nhop (rt (\<sigma> i)) dip) = dip
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
the (nhop (rt (\<sigma> i)) dip) = dip

goal (1 subgoal):
 1. sqn (rt (\<sigma> i)) dip = 0 \<Longrightarrow> False
[PROOF STEP]
with \<open>?nhip \<noteq> dip\<close>
[PROOF STATE]
proof (chain)
picking this:
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
the (nhop (rt (\<sigma> i)) dip) = dip
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
the (nhop (rt (\<sigma> i)) dip) = dip

goal (1 subgoal):
 1. False
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
0 < sqn (rt (\<sigma> i)) dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
0 < sqn (rt (\<sigma> i)) dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
have "... = nsqn (rt (\<sigma> i)) dip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sqn (rt (\<sigma> i)) dip = nsqn (rt (\<sigma> i)) dip
[PROOF STEP]
by (rule vD_nsqn_sqn [OF \<open>dip\<in>vD(rt (\<sigma> i))\<close>, THEN sym])
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma> i)) dip = nsqn (rt (\<sigma> i)) dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma> i)) dip = nsqn (rt (\<sigma> i)) dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
have "... \<le> nsqn (rt (\<sigma> ?nhip)) dip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
by (rule nsqns)
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
have "... \<le> sqn (rt (\<sigma> ?nhip)) dip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip \<le> sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
by (rule nsqn_sqn)
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip \<le> sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
0 < sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
have "0 < sqn (rt (\<sigma> ?nhip)) dip"
[PROOF STATE]
proof (prove)
using this:
0 < sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. 0 < sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
0 < sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
have "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' ?nhip)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
proof (cases "dip\<in>vD(rt (\<sigma> ?nhip))")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
 2. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
assume "dip\<in>vD(rt (\<sigma> ?nhip))"
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (2 subgoals):
 1. dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
 2. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
with pre \<open>dip\<in>vD(rt (\<sigma> i))\<close> and \<open>?nhip \<noteq> dip\<close>
[PROOF STATE]
proof (chain)
picking this:
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
dip \<in> vD (rt (\<sigma> i))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
have "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> ?nhip)"
[PROOF STATE]
proof (prove)
using this:
\<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<and> dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
dip \<in> vD (rt (\<sigma> i))
the (nhop (rt (\<sigma> i)) dip) \<noteq> dip
dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (2 subgoals):
 1. dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
 2. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))

goal (2 subgoals):
 1. dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
 2. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
from \<open>\<forall>j. quality_increases (\<sigma> j) (\<sigma>' j)\<close>
[PROOF STATE]
proof (chain)
picking this:
\<forall>j. quality_increases (\<sigma> j) (\<sigma>' j)
[PROOF STEP]
have "quality_increases (\<sigma> ?nhip) (\<sigma>' ?nhip)"
[PROOF STATE]
proof (prove)
using this:
\<forall>j. quality_increases (\<sigma> j) (\<sigma>' j)

goal (1 subgoal):
 1. quality_increases (\<sigma> (the (nhop (rt (\<sigma> i)) dip))) (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
quality_increases (\<sigma> (the (nhop (rt (\<sigma> i)) dip))) (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (2 subgoals):
 1. dip \<in> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
 2. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
quality_increases (\<sigma> (the (nhop (rt (\<sigma> i)) dip))) (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
quality_increases (\<sigma> (the (nhop (rt (\<sigma> i)) dip))) (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
using \<open>dip\<in>kD(rt (\<sigma> ?nhip))\<close>
[PROOF STATE]
proof (prove)
using this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))
quality_increases (\<sigma> (the (nhop (rt (\<sigma> i)) dip))) (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
dip \<in> kD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
by (rule strictly_fresher_quality_increases_right)
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
assume "dip\<notin>vD(rt (\<sigma> ?nhip))"
[PROOF STATE]
proof (state)
this:
dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
with \<open>dip\<in>kD(rt (\<sigma> ?nhip))\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<in> kD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
have "dip\<in>iD(rt (\<sigma> ?nhip))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> kD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. dip \<in> iD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
dip \<in> iD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
hence "the (flag (rt (\<sigma> ?nhip)) dip) = inv"
[PROOF STATE]
proof (prove)
using this:
dip \<in> iD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. the (flag (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip) = Aodv_Basic.inv
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
the (flag (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip) = Aodv_Basic.inv

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
have "nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> ?nhip)) dip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
by (rule nsqns)
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> i)) dip \<le> nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
from \<open>dip\<in>iD(rt (\<sigma> ?nhip))\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<in> iD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
have "... = sqn (rt (\<sigma> ?nhip)) dip - 1"
[PROOF STATE]
proof (prove)
using this:
dip \<in> iD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip = sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip = sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip = sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
have "... < sqn (rt (\<sigma>' ?nhip)) dip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1 < sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1 < sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
from \<open>\<forall>j. quality_increases (\<sigma> j) (\<sigma>' j)\<close>
[PROOF STATE]
proof (chain)
picking this:
\<forall>j. quality_increases (\<sigma> j) (\<sigma>' j)
[PROOF STEP]
have "quality_increases (\<sigma> ?nhip) (\<sigma>' ?nhip)"
[PROOF STATE]
proof (prove)
using this:
\<forall>j. quality_increases (\<sigma> j) (\<sigma>' j)

goal (1 subgoal):
 1. quality_increases (\<sigma> (the (nhop (rt (\<sigma> i)) dip))) (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
quality_increases (\<sigma> (the (nhop (rt (\<sigma> i)) dip))) (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1 < sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
hence "\<forall>ip. sqn (rt (\<sigma> ?nhip)) ip \<le> sqn (rt (\<sigma>' ?nhip)) ip"
[PROOF STATE]
proof (prove)
using this:
quality_increases (\<sigma> (the (nhop (rt (\<sigma> i)) dip))) (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. \<forall>ip. sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) ip \<le> sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) ip
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>ip. sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) ip \<le> sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) ip

goal (1 subgoal):
 1. sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1 < sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
hence "sqn (rt (\<sigma> ?nhip)) dip \<le> sqn (rt (\<sigma>' ?nhip)) dip"
[PROOF STATE]
proof (prove)
using this:
\<forall>ip. sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) ip \<le> sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) ip

goal (1 subgoal):
 1. sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip \<le> sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip \<le> sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1 < sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
with \<open>0 < sqn (rt (\<sigma> ?nhip)) dip\<close>
[PROOF STATE]
proof (chain)
picking this:
0 < sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip
sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip \<le> sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
0 < sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip
sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip \<le> sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1 < sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1 < sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1 < sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) dip - 1 < sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
have "... = nsqn (rt (\<sigma>' ?nhip)) dip"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip = nsqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
proof (rule vD_nsqn_sqn [THEN sym])
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
from \<open>dip\<in>vD(rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip))))\<close> and \<open>\<sigma>' i = \<sigma> i\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip))))
\<sigma>' i = \<sigma> i
[PROOF STEP]
show "dip\<in>vD(rt (\<sigma>' ?nhip))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip))))
\<sigma>' i = \<sigma> i

goal (1 subgoal):
 1. dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
sqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip = nsqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
nsqn (rt (\<sigma> i)) dip < nsqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
have "nsqn (rt (\<sigma> i)) dip < nsqn (rt (\<sigma>' ?nhip)) dip"
[PROOF STATE]
proof (prove)
using this:
nsqn (rt (\<sigma> i)) dip < nsqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. nsqn (rt (\<sigma> i)) dip < nsqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> i)) dip < nsqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
nsqn (rt (\<sigma> i)) dip < nsqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
from \<open>dip\<in>vD(rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip))))\<close> and \<open>\<sigma>' i = \<sigma> i\<close>
[PROOF STATE]
proof (chain)
picking this:
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip))))
\<sigma>' i = \<sigma> i
[PROOF STEP]
have "dip\<in>kD(rt (\<sigma>' ?nhip))"
[PROOF STATE]
proof (prove)
using this:
dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip))))
\<sigma>' i = \<sigma> i

goal (1 subgoal):
 1. dip \<in> kD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dip \<in> kD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. dip \<notin> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<Longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
nsqn (rt (\<sigma> i)) dip < nsqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
dip \<in> kD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
show "rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' ?nhip)"
[PROOF STATE]
proof (prove)
using this:
nsqn (rt (\<sigma> i)) dip < nsqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
dip \<in> kD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
using \<open>dip\<in>kD(rt (\<sigma> i))\<close>
[PROOF STATE]
proof (prove)
using this:
nsqn (rt (\<sigma> i)) dip < nsqn (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))) dip
dip \<in> kD (rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip))))
dip \<in> kD (rt (\<sigma> i))

goal (1 subgoal):
 1. rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
by - (rule rt_strictly_fresher_ltI)
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. \<And>dip. \<lbrakk>dip \<in> vD (rt (\<sigma>' i)); dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))); the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip\<rbrakk> \<Longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
with \<open>\<sigma>' i = \<sigma> i\<close>
[PROOF STATE]
proof (chain)
picking this:
\<sigma>' i = \<sigma> i
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))
[PROOF STEP]
show "rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))"
[PROOF STATE]
proof (prove)
using this:
\<sigma>' i = \<sigma> i
rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma> i)) dip)))

goal (1 subgoal):
 1. rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>dip. dip \<in> vD (rt (\<sigma>' i)) \<and> dip \<in> vD (rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))) \<and> the (nhop (rt (\<sigma>' i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma>' i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma>' (the (nhop (rt (\<sigma>' i)) dip)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))
[PROOF STEP]
unfolding Let_def
[PROOF STATE]
proof (prove)
using this:
opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))

goal (1 subgoal):
 1. opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip)))) \<and> the (nhop (rt (\<sigma> i)) dip) \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> (the (nhop (rt (\<sigma> i)) dip))))
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
opaodv i \<Turnstile> (otherwith (=) {i} (orecvmsg (\<lambda>\<sigma> m. msg_fresh \<sigma> m \<and> msg_zhops m)), other quality_increases {i} \<rightarrow>) onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<sigma>, uu_). \<forall>dip. let nhip = the (nhop (rt (\<sigma> i)) dip) in dip \<in> vD (rt (\<sigma> i)) \<inter> vD (rt (\<sigma> nhip)) \<and> nhip \<noteq> dip \<longrightarrow> rt (\<sigma> i) \<sqsubset>\<^bsub>dip\<^esub> rt (\<sigma> nhip))

goal:
No subgoals!
[PROOF STEP]
qed