[STATEMENT]
lemma rett_instr_low_equal:
assumes a1: "low_equal s1 s2 \<and>
\<not> snd (rett_instr instr s1) \<and>
\<not> snd (rett_instr instr s2) \<and>
(((get_S (cpu_reg_val PSR s1)))::word1) = 0 \<and>
(((get_S (cpu_reg_val PSR s2)))::word1) = 0 \<and>
t1 = snd (fst (rett_instr instr s1)) \<and> t2 = snd (fst (rett_instr instr s2))"
shows "low_equal t1 t2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. low_equal t1 t2
[PROOF STEP]
using a1
[PROOF STATE]
proof (prove)
using this:
low_equal s1 s2 \<and> \<not> snd (rett_instr instr s1) \<and> \<not> snd (rett_instr instr s2) \<and> get_S (cpu_reg_val PSR s1) = 0 \<and> get_S (cpu_reg_val PSR s2) = 0 \<and> t1 = snd (fst (rett_instr instr s1)) \<and> t2 = snd (fst (rett_instr instr s2))

goal (1 subgoal):
 1. low_equal t1 t2
[PROOF STEP]
apply (simp add: rett_instr_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. low_equal s1 s2 \<and> \<not> snd ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
curr_win \<leftarrow> gets (\<lambda>s. get_CWP (cpu_reg_val PSR s));
addr \<leftarrow> gets (get_addr (snd instr));
wim_val \<leftarrow> gets (cpu_reg_val WIM);
npc_val \<leftarrow> gets (cpu_reg_val nPC);
if get_ET psr_val = 1 then if get_S psr_val = 0 then do raise_trap privileged_instruction;
return ()
od else do raise_trap illegal_instruction;
return ()
od else if get_S psr_val = 0 then do write_cpu_tt 3;
set_exe_mode False;
set_err_mode True;
raise_trap privileged_instruction;
fail ()
od else if get_WIM_bit (nat ((uint curr_win + 1) mod NWINDOWS)) wim_val \<noteq> 0 then do write_cpu_tt 6;
set_exe_mode False;
set_err_mode True;
raise_trap window_underflow;
fail ()
od else if addr AND 3 \<noteq> 0 then do write_cpu_tt 7;
set_exe_mode False;
set_err_mode True;
raise_trap mem_address_not_aligned;
fail ()
od else do write_cpu npc_val PC;
write_cpu addr nPC;
new_psr_val \<leftarrow> gets (\<lambda>s. update_PSR_rett (word_of_int ((uint curr_win + 1) mod NWINDOWS)) 1 (get_PS psr_val) psr_val);
write_cpu new_psr_val PSR;
return ()
od
od) s1) \<and> \<not> snd ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
curr_win \<leftarrow> gets (\<lambda>s. get_CWP (cpu_reg_val PSR s));
addr \<leftarrow> gets (get_addr (snd instr));
wim_val \<leftarrow> gets (cpu_reg_val WIM);
npc_val \<leftarrow> gets (cpu_reg_val nPC);
if get_ET psr_val = 1 then if get_S psr_val = 0 then do raise_trap privileged_instruction;
return ()
od else do raise_trap illegal_instruction;
return ()
od else if get_S psr_val = 0 then do write_cpu_tt 3;
set_exe_mode False;
set_err_mode True;
raise_trap privileged_instruction;
fail ()
od else if get_WIM_bit (nat ((uint curr_win + 1) mod NWINDOWS)) wim_val \<noteq> 0 then do write_cpu_tt 6;
set_exe_mode False;
set_err_mode True;
raise_trap window_underflow;
fail ()
od else if addr AND 3 \<noteq> 0 then do write_cpu_tt 7;
set_exe_mode False;
set_err_mode True;
raise_trap mem_address_not_aligned;
fail ()
od else do write_cpu npc_val PC;
write_cpu addr nPC;
new_psr_val \<leftarrow> gets (\<lambda>s. update_PSR_rett (word_of_int ((uint curr_win + 1) mod NWINDOWS)) 1 (get_PS psr_val) psr_val);
write_cpu new_psr_val PSR;
return ()
od
od) s2) \<and> get_S (cpu_reg_val PSR s1) = 0 \<and> get_S (cpu_reg_val PSR s2) = 0 \<and> t1 = snd (fst ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
curr_win \<leftarrow> gets (\<lambda>s. get_CWP (cpu_reg_val PSR s));
addr \<leftarrow> gets (get_addr (snd instr));
wim_val \<leftarrow> gets (cpu_reg_val WIM);
npc_val \<leftarrow> gets (cpu_reg_val nPC);
if get_ET psr_val = 1 then if get_S psr_val = 0 then do raise_trap privileged_instruction;
return ()
od else do raise_trap illegal_instruction;
return ()
od else if get_S psr_val = 0 then do write_cpu_tt 3;
set_exe_mode False;
set_err_mode True;
raise_trap privileged_instruction;
fail ()
od else if get_WIM_bit (nat ((uint curr_win + 1) mod NWINDOWS)) wim_val \<noteq> 0 then do write_cpu_tt 6;
set_exe_mode False;
set_err_mode True;
raise_trap window_underflow;
fail ()
od else if addr AND 3 \<noteq> 0 then do write_cpu_tt 7;
set_exe_mode False;
set_err_mode True;
raise_trap mem_address_not_aligned;
fail ()
od else do write_cpu npc_val PC;
write_cpu addr nPC;
new_psr_val \<leftarrow> gets (\<lambda>s. update_PSR_rett (word_of_int ((uint curr_win + 1) mod NWINDOWS)) 1 (get_PS psr_val) psr_val);
write_cpu new_psr_val PSR;
return ()
od
od) s1)) \<and> t2 = snd (fst ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
curr_win \<leftarrow> gets (\<lambda>s. get_CWP (cpu_reg_val PSR s));
addr \<leftarrow> gets (get_addr (snd instr));
wim_val \<leftarrow> gets (cpu_reg_val WIM);
npc_val \<leftarrow> gets (cpu_reg_val nPC);
if get_ET psr_val = 1 then if get_S psr_val = 0 then do raise_trap privileged_instruction;
return ()
od else do raise_trap illegal_instruction;
return ()
od else if get_S psr_val = 0 then do write_cpu_tt 3;
set_exe_mode False;
set_err_mode True;
raise_trap privileged_instruction;
fail ()
od else if get_WIM_bit (nat ((uint curr_win + 1) mod NWINDOWS)) wim_val \<noteq> 0 then do write_cpu_tt 6;
set_exe_mode False;
set_err_mode True;
raise_trap window_underflow;
fail ()
od else if addr AND 3 \<noteq> 0 then do write_cpu_tt 7;
set_exe_mode False;
set_err_mode True;
raise_trap mem_address_not_aligned;
fail ()
od else do write_cpu npc_val PC;
write_cpu addr nPC;
new_psr_val \<leftarrow> gets (\<lambda>s. update_PSR_rett (word_of_int ((uint curr_win + 1) mod NWINDOWS)) 1 (get_PS psr_val) psr_val);
write_cpu new_psr_val PSR;
return ()
od
od) s2)) \<Longrightarrow> low_equal (snd (fst ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
curr_win \<leftarrow> gets (\<lambda>s. get_CWP (cpu_reg_val PSR s));
addr \<leftarrow> gets (get_addr (snd instr));
wim_val \<leftarrow> gets (cpu_reg_val WIM);
npc_val \<leftarrow> gets (cpu_reg_val nPC);
if get_ET psr_val = 1 then if get_S psr_val = 0 then do raise_trap privileged_instruction;
return ()
od else do raise_trap illegal_instruction;
return ()
od else if get_S psr_val = 0 then do write_cpu_tt 3;
set_exe_mode False;
set_err_mode True;
raise_trap privileged_instruction;
fail ()
od else if get_WIM_bit (nat ((uint curr_win + 1) mod NWINDOWS)) wim_val \<noteq> 0 then do write_cpu_tt 6;
set_exe_mode False;
set_err_mode True;
raise_trap window_underflow;
fail ()
od else if addr AND 3 \<noteq> 0 then do write_cpu_tt 7;
set_exe_mode False;
set_err_mode True;
raise_trap mem_address_not_aligned;
fail ()
od else do write_cpu npc_val PC;
write_cpu addr nPC;
new_psr_val \<leftarrow> gets (\<lambda>s. update_PSR_rett (word_of_int ((uint curr_win + 1) mod NWINDOWS)) 1 (get_PS psr_val) psr_val);
write_cpu new_psr_val PSR;
return ()
od
od) s1))) (snd (fst ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
curr_win \<leftarrow> gets (\<lambda>s. get_CWP (cpu_reg_val PSR s));
addr \<leftarrow> gets (get_addr (snd instr));
wim_val \<leftarrow> gets (cpu_reg_val WIM);
npc_val \<leftarrow> gets (cpu_reg_val nPC);
if get_ET psr_val = 1 then if get_S psr_val = 0 then do raise_trap privileged_instruction;
return ()
od else do raise_trap illegal_instruction;
return ()
od else if get_S psr_val = 0 then do write_cpu_tt 3;
set_exe_mode False;
set_err_mode True;
raise_trap privileged_instruction;
fail ()
od else if get_WIM_bit (nat ((uint curr_win + 1) mod NWINDOWS)) wim_val \<noteq> 0 then do write_cpu_tt 6;
set_exe_mode False;
set_err_mode True;
raise_trap window_underflow;
fail ()
od else if addr AND 3 \<noteq> 0 then do write_cpu_tt 7;
set_exe_mode False;
set_err_mode True;
raise_trap mem_address_not_aligned;
fail ()
od else do write_cpu npc_val PC;
write_cpu addr nPC;
new_psr_val \<leftarrow> gets (\<lambda>s. update_PSR_rett (word_of_int ((uint curr_win + 1) mod NWINDOWS)) 1 (get_PS psr_val) psr_val);
write_cpu new_psr_val PSR;
return ()
od
od) s2)))
[PROOF STEP]
apply (simp add: simpler_gets_def bind_def h1_def h2_def Let_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. low_equal s1 s2 \<and> \<not> snd ((if get_ET (cpu_reg_val PSR s1) = 1 then if get_S (cpu_reg_val PSR s1) = 0 then do raise_trap privileged_instruction;
return ()
od else do raise_trap illegal_instruction;
return ()
od else if get_S (cpu_reg_val PSR s1) = 0 then do write_cpu_tt 3;
set_exe_mode False;
set_err_mode True;
raise_trap privileged_instruction;
fail ()
od else if get_WIM_bit (nat ((uint (get_CWP (cpu_reg_val PSR s1)) + 1) mod NWINDOWS)) (cpu_reg_val WIM s1) \<noteq> 0 then do write_cpu_tt 6;
set_exe_mode False;
set_err_mode True;
raise_trap window_underflow;
fail ()
od else if get_addr (snd instr) s1 AND 3 \<noteq> 0 then do write_cpu_tt 7;
set_exe_mode False;
set_err_mode True;
raise_trap mem_address_not_aligned;
fail ()
od else do write_cpu (cpu_reg_val nPC s1) PC;
write_cpu (get_addr (snd instr) s1) nPC;
new_psr_val \<leftarrow> gets (\<lambda>s. update_PSR_rett (word_of_int ((uint (get_CWP (cpu_reg_val PSR s1)) + 1) mod NWINDOWS)) 1 (get_PS (cpu_reg_val PSR s1)) (cpu_reg_val PSR s1));
write_cpu new_psr_val PSR;
return ()
od) s1) \<and> \<not> snd ((if get_ET (cpu_reg_val PSR s2) = 1 then if get_S (cpu_reg_val PSR s2) = 0 then do raise_trap privileged_instruction;
return ()
od else do raise_trap illegal_instruction;
return ()
od else if get_S (cpu_reg_val PSR s2) = 0 then do write_cpu_tt 3;
set_exe_mode False;
set_err_mode True;
raise_trap privileged_instruction;
fail ()
od else if get_WIM_bit (nat ((uint (get_CWP (cpu_reg_val PSR s2)) + 1) mod NWINDOWS)) (cpu_reg_val WIM s2) \<noteq> 0 then do write_cpu_tt 6;
set_exe_mode False;
set_err_mode True;
raise_trap window_underflow;
fail ()
od else if get_addr (snd instr) s2 AND 3 \<noteq> 0 then do write_cpu_tt 7;
set_exe_mode False;
set_err_mode True;
raise_trap mem_address_not_aligned;
fail ()
od else do write_cpu (cpu_reg_val nPC s2) PC;
write_cpu (get_addr (snd instr) s2) nPC;
new_psr_val \<leftarrow> gets (\<lambda>s. update_PSR_rett (word_of_int ((uint (get_CWP (cpu_reg_val PSR s2)) + 1) mod NWINDOWS)) 1 (get_PS (cpu_reg_val PSR s2)) (cpu_reg_val PSR s2));
write_cpu new_psr_val PSR;
return ()
od) s2) \<and> get_S (cpu_reg_val PSR s1) = 0 \<and> get_S (cpu_reg_val PSR s2) = 0 \<and> t1 = snd (fst ((if get_ET (cpu_reg_val PSR s1) = 1 then if get_S (cpu_reg_val PSR s1) = 0 then do raise_trap privileged_instruction;
return ()
od else do raise_trap illegal_instruction;
return ()
od else if get_S (cpu_reg_val PSR s1) = 0 then do write_cpu_tt 3;
set_exe_mode False;
set_err_mode True;
raise_trap privileged_instruction;
fail ()
od else if get_WIM_bit (nat ((uint (get_CWP (cpu_reg_val PSR s1)) + 1) mod NWINDOWS)) (cpu_reg_val WIM s1) \<noteq> 0 then do write_cpu_tt 6;
set_exe_mode False;
set_err_mode True;
raise_trap window_underflow;
fail ()
od else if get_addr (snd instr) s1 AND 3 \<noteq> 0 then do write_cpu_tt 7;
set_exe_mode False;
set_err_mode True;
raise_trap mem_address_not_aligned;
fail ()
od else do write_cpu (cpu_reg_val nPC s1) PC;
write_cpu (get_addr (snd instr) s1) nPC;
new_psr_val \<leftarrow> gets (\<lambda>s. update_PSR_rett (word_of_int ((uint (get_CWP (cpu_reg_val PSR s1)) + 1) mod NWINDOWS)) 1 (get_PS (cpu_reg_val PSR s1)) (cpu_reg_val PSR s1));
write_cpu new_psr_val PSR;
return ()
od) s1)) \<and> t2 = snd (fst ((if get_ET (cpu_reg_val PSR s2) = 1 then if get_S (cpu_reg_val PSR s2) = 0 then do raise_trap privileged_instruction;
return ()
od else do raise_trap illegal_instruction;
return ()
od else if get_S (cpu_reg_val PSR s2) = 0 then do write_cpu_tt 3;
set_exe_mode False;
set_err_mode True;
raise_trap privileged_instruction;
fail ()
od else if get_WIM_bit (nat ((uint (get_CWP (cpu_reg_val PSR s2)) + 1) mod NWINDOWS)) (cpu_reg_val WIM s2) \<noteq> 0 then do write_cpu_tt 6;
set_exe_mode False;
set_err_mode True;
raise_trap window_underflow;
fail ()
od else if get_addr (snd instr) s2 AND 3 \<noteq> 0 then do write_cpu_tt 7;
set_exe_mode False;
set_err_mode True;
raise_trap mem_address_not_aligned;
fail ()
od else do write_cpu (cpu_reg_val nPC s2) PC;
write_cpu (get_addr (snd instr) s2) nPC;
new_psr_val \<leftarrow> gets (\<lambda>s. update_PSR_rett (word_of_int ((uint (get_CWP (cpu_reg_val PSR s2)) + 1) mod NWINDOWS)) 1 (get_PS (cpu_reg_val PSR s2)) (cpu_reg_val PSR s2));
write_cpu new_psr_val PSR;
return ()
od) s2)) \<Longrightarrow> (get_ET (cpu_reg_val PSR s1) = 1 \<longrightarrow> (get_ET (cpu_reg_val PSR s2) = 1 \<longrightarrow> low_equal (snd (fst (case fst (raise_trap privileged_instruction s1) of (x, xa) \<Rightarrow> return x xa))) (snd (fst (case fst (raise_trap privileged_instruction s2) of (x, xa) \<Rightarrow> return x xa)))) \<and> (get_ET (cpu_reg_val PSR s2) \<noteq> 1 \<longrightarrow> low_equal (snd (fst (case fst (raise_trap privileged_instruction s1) of (x, xa) \<Rightarrow> return x xa))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))))) \<and> (get_ET (cpu_reg_val PSR s1) \<noteq> 1 \<longrightarrow> (get_ET (cpu_reg_val PSR s2) = 1 \<longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (raise_trap privileged_instruction s2) of (x, xa) \<Rightarrow> return x xa)))) \<and> (get_ET (cpu_reg_val PSR s2) \<noteq> 1 \<longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))))
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>low_equal s1 s2; \<not> snd (raise_trap privileged_instruction s1); \<not> snd (raise_trap privileged_instruction s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst (raise_trap privileged_instruction s1)); t2 = snd (fst (raise_trap privileged_instruction s2)); get_ET (cpu_reg_val PSR s1) = 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (raise_trap privileged_instruction s1) of (x, xa) \<Rightarrow> return x xa))) (snd (fst (case fst (raise_trap privileged_instruction s2) of (x, xa) \<Rightarrow> return x xa)))
 2. \<lbrakk>low_equal s1 s2; \<not> snd (raise_trap privileged_instruction s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst (raise_trap privileged_instruction s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) = 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (raise_trap privileged_instruction s1) of (x, xa) \<Rightarrow> return x xa))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
 3. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd (raise_trap privileged_instruction s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst (raise_trap privileged_instruction s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (raise_trap privileged_instruction s2) of (x, xa) \<Rightarrow> return x xa)))
 4. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
[PROOF STEP]
apply (simp add: raise_trap_def add_trap_set_def simpler_modify_def)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>low_equal s1 s2; get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = s1\<lparr>traps := insert privileged_instruction (traps s1)\<rparr>; t2 = s2\<lparr>traps := insert privileged_instruction (traps s2)\<rparr>; get_ET (cpu_reg_val PSR s1) = 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (return () (s1\<lparr>traps := insert privileged_instruction (traps s1)\<rparr>)))) (snd (fst (return () (s2\<lparr>traps := insert privileged_instruction (traps s2)\<rparr>))))
 2. \<lbrakk>low_equal s1 s2; \<not> snd (raise_trap privileged_instruction s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst (raise_trap privileged_instruction s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) = 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (raise_trap privileged_instruction s1) of (x, xa) \<Rightarrow> return x xa))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
 3. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd (raise_trap privileged_instruction s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst (raise_trap privileged_instruction s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (raise_trap privileged_instruction s2) of (x, xa) \<Rightarrow> return x xa)))
 4. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
[PROOF STEP]
apply (simp add: return_def)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>low_equal s1 s2; get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = s1\<lparr>traps := insert privileged_instruction (traps s1)\<rparr>; t2 = s2\<lparr>traps := insert privileged_instruction (traps s2)\<rparr>; get_ET (cpu_reg_val PSR s1) = 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (s1\<lparr>traps := insert privileged_instruction (traps s1)\<rparr>) (s2\<lparr>traps := insert privileged_instruction (traps s2)\<rparr>)
 2. \<lbrakk>low_equal s1 s2; \<not> snd (raise_trap privileged_instruction s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst (raise_trap privileged_instruction s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) = 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (raise_trap privileged_instruction s1) of (x, xa) \<Rightarrow> return x xa))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
 3. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd (raise_trap privileged_instruction s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst (raise_trap privileged_instruction s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (raise_trap privileged_instruction s2) of (x, xa) \<Rightarrow> return x xa)))
 4. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
[PROOF STEP]
using mod_trap_low_equal traps_low_equal
[PROOF STATE]
proof (prove)
using this:
low_equal ?s1.0 ?s2.0 \<and> ?t1.0 = ?s1.0\<lparr>traps := ?new_traps\<rparr> \<and> ?t2.0 = ?s2.0\<lparr>traps := ?new_traps\<rparr> \<Longrightarrow> low_equal ?t1.0 ?t2.0
low_equal ?s1.0 ?s2.0 \<Longrightarrow> traps ?s1.0 = traps ?s2.0

goal (4 subgoals):
 1. \<lbrakk>low_equal s1 s2; get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = s1\<lparr>traps := insert privileged_instruction (traps s1)\<rparr>; t2 = s2\<lparr>traps := insert privileged_instruction (traps s2)\<rparr>; get_ET (cpu_reg_val PSR s1) = 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (s1\<lparr>traps := insert privileged_instruction (traps s1)\<rparr>) (s2\<lparr>traps := insert privileged_instruction (traps s2)\<rparr>)
 2. \<lbrakk>low_equal s1 s2; \<not> snd (raise_trap privileged_instruction s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst (raise_trap privileged_instruction s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) = 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (raise_trap privileged_instruction s1) of (x, xa) \<Rightarrow> return x xa))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
 3. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd (raise_trap privileged_instruction s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst (raise_trap privileged_instruction s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (raise_trap privileged_instruction s2) of (x, xa) \<Rightarrow> return x xa)))
 4. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>low_equal s1 s2; \<not> snd (raise_trap privileged_instruction s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst (raise_trap privileged_instruction s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) = 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (raise_trap privileged_instruction s1) of (x, xa) \<Rightarrow> return x xa))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
 2. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd (raise_trap privileged_instruction s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst (raise_trap privileged_instruction s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (raise_trap privileged_instruction s2) of (x, xa) \<Rightarrow> return x xa)))
 3. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
[PROOF STEP]
using cpu_reg_val_low_equal
[PROOF STATE]
proof (prove)
using this:
low_equal ?s1.0 ?s2.0 \<Longrightarrow> cpu_reg_val ?cr ?s1.0 = cpu_reg_val ?cr ?s2.0

goal (3 subgoals):
 1. \<lbrakk>low_equal s1 s2; \<not> snd (raise_trap privileged_instruction s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst (raise_trap privileged_instruction s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) = 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (raise_trap privileged_instruction s1) of (x, xa) \<Rightarrow> return x xa))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
 2. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd (raise_trap privileged_instruction s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst (raise_trap privileged_instruction s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (raise_trap privileged_instruction s2) of (x, xa) \<Rightarrow> return x xa)))
 3. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd (raise_trap privileged_instruction s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst (raise_trap privileged_instruction s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (raise_trap privileged_instruction s2) of (x, xa) \<Rightarrow> return x xa)))
 2. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
[PROOF STEP]
using cpu_reg_val_low_equal
[PROOF STATE]
proof (prove)
using this:
low_equal ?s1.0 ?s2.0 \<Longrightarrow> cpu_reg_val ?cr ?s1.0 = cpu_reg_val ?cr ?s2.0

goal (2 subgoals):
 1. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd (raise_trap privileged_instruction s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst (raise_trap privileged_instruction s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) = 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (raise_trap privileged_instruction s2) of (x, xa) \<Rightarrow> return x xa)))
 2. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>low_equal s1 s2; \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1); \<not> snd ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s1)); t2 = snd (fst ((do y \<leftarrow> write_cpu_tt 3;
y \<leftarrow> set_exe_mode False;
y \<leftarrow> set_err_mode True;
raise_trap privileged_instruction >>= fail
od) s2)); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
[PROOF STEP]
apply (simp add: bind_def h1_def h2_def Let_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>low_equal s1 s2; \<not> snd (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))) \<and> \<not> snd (write_cpu_tt 3 s1); \<not> snd (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))) \<and> \<not> snd (write_cpu_tt 3 s2); get_S (cpu_reg_val PSR s1) = 0; get_S (cpu_reg_val PSR s2) = 0; t1 = snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))); t2 = snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))); get_ET (cpu_reg_val PSR s1) \<noteq> 1; get_ET (cpu_reg_val PSR s2) \<noteq> 1\<rbrakk> \<Longrightarrow> low_equal (snd (fst (case fst (write_cpu_tt 3 s1) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b))))) (snd (fst (case fst (write_cpu_tt 3 s2) of (a, b) \<Rightarrow> (fst (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))), snd (case fst (set_exe_mode False b) of (a, b) \<Rightarrow> (fst (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))), snd (case fst (set_err_mode True b) of (a, b) \<Rightarrow> (fst (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa), snd (case fst (raise_trap privileged_instruction b) of (x, xa) \<Rightarrow> fail x xa) \<or> snd (raise_trap privileged_instruction b))) \<or> snd (set_err_mode True b))) \<or> snd (set_exe_mode False b)))))
[PROOF STEP]
by (simp add: case_prod_unfold fail_def)


[STATEMENT]
lemma shadow_root_delete_get_6 [simp]:
  "delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t shadow_root_ptr h = Some h' \<Longrightarrow> get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h' = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t shadow_root_ptr h = Some h' \<Longrightarrow> get document_ptr h' = get document_ptr h
[PROOF STEP]
by(simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)