[STATEMENT]
lemma Call_lemma:
 assumes
 Call: "\<forall>q \<in> dom \<Gamma>. \<forall>Z. \<Gamma>,\<Theta> \<turnstile>\<^sub>t\<^bsub>/F\<^esub>
                 {s. s=Z \<and> \<Gamma>\<turnstile>\<langle>Call q,Normal s\<rangle> \<Rightarrow>\<notin>({Stuck} \<union> Fault ` (-F)) \<and>
                    \<Gamma>\<turnstile>Call q\<down>Normal s \<and> ((s,q),(\<sigma>,p)) \<in> termi_call_steps \<Gamma>}
                 (Call q)
                {t. \<Gamma>\<turnstile>\<langle>Call q,Normal Z\<rangle> \<Rightarrow> Normal t},
                {t. \<Gamma>\<turnstile>\<langle>Call q,Normal Z\<rangle> \<Rightarrow> Abrupt t}"
 shows "\<And>Z. \<Gamma>,\<Theta> \<turnstile>\<^sub>t\<^bsub>/F\<^esub>
              ({\<sigma>} \<inter> {s. s=Z \<and> \<Gamma>\<turnstile>\<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>({Stuck} \<union> Fault ` (-F)) \<and>
                                 \<Gamma>\<turnstile>the (\<Gamma> p)\<down>Normal s})
                 the (\<Gamma> p)
              {t. \<Gamma>\<turnstile>\<langle>the (\<Gamma> p),Normal Z\<rangle> \<Rightarrow> Normal t},
              {t. \<Gamma>\<turnstile>\<langle>the (\<Gamma> p),Normal Z\<rangle> \<Rightarrow> Abrupt t}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>the (\<Gamma> p) \<down> Normal s}) the (\<Gamma> p) {t. \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal Z\<rangle> \<Rightarrow> Normal t},{t. \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal Z\<rangle> \<Rightarrow> Abrupt t}
[PROOF STEP]
apply (rule conseqPre)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> (?P' Z) the (\<Gamma> p) {t. \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal Z\<rangle> \<Rightarrow> Normal t},{t. \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal Z\<rangle> \<Rightarrow> Abrupt t}
 2. \<And>Z. {\<sigma>} \<inter> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>the (\<Gamma> p) \<down> Normal s} \<subseteq> ?P' Z
[PROOF STEP]
apply (rule Call_lemma')
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>Z. \<forall>q\<in>dom \<Gamma>. \<forall>Za. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> {s. s = Za \<and> \<Gamma>\<turnstile> \<langle>Call q,Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>Call q \<down> Normal s \<and> ((s, q), ?\<sigma>3 Z, ?p3 Z) \<in> termi_call_steps \<Gamma>} Call q {t. \<Gamma>\<turnstile> \<langle>Call q,Normal Za\<rangle> \<Rightarrow> Normal t},{t. \<Gamma>\<turnstile> \<langle>Call q,Normal Za\<rangle> \<Rightarrow> Abrupt t}
 2. \<And>Z. {\<sigma>} \<inter> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>the (\<Gamma> p) \<down> Normal s} \<subseteq> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>the (\<Gamma> (?p3 Z)) \<down> Normal (?\<sigma>3 Z) \<and> (\<exists>cs css. \<Gamma>\<turnstile> ([the (\<Gamma> (?p3 Z))], [], Normal (?\<sigma>3 Z)) \<rightarrow>\<^sup>* (the (\<Gamma> p) # cs, css, Normal s))}
[PROOF STEP]
apply (rule Call)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Z. {\<sigma>} \<inter> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>the (\<Gamma> p) \<down> Normal s} \<subseteq> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>the (\<Gamma> p) \<down> Normal \<sigma> \<and> (\<exists>cs css. \<Gamma>\<turnstile> ([the (\<Gamma> p)], [], Normal \<sigma>) \<rightarrow>\<^sup>* (the (\<Gamma> p) # cs, css, Normal s))}
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma (in K2_algebra) "(\<not> 1 \<le>  x) \<longrightarrow>  x = x \<cdot> y + z \<longrightarrow> x = z \<cdot> y\<^sup>\<star>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> (1::'a) \<le> x \<longrightarrow> x = x \<cdot> y + z \<longrightarrow> x = z \<cdot> y\<^sup>\<star>
[PROOF STEP]
oops


[STATEMENT]
lemma mred_known_addrs_typing':
  assumes wf: "wf_J_prog P"
  and ok: "h.start_heap_ok"
  shows "known_addrs_typing' addr2thread_id thread_id2addr empty_heap allocate typeof_addr heap_write allocated h.J_known_addrs final_expr (h.mred P) (\<lambda>t x h. \<exists>ET. h.sconf_type_ok ET t x h) P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. known_addrs_typing' addr2thread_id thread_id2addr empty_heap allocate typeof_addr heap_write allocated h.J_known_addrs final_expr (\<lambda>t ((e, l), h) ta ((e', l'), h'). h.red (extTA2J P) P t e (h, l) ta e' (h', l')) (\<lambda>t x h. \<exists>ET. h.sconf_type_ok ET t x h) P
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. known_addrs_typing' addr2thread_id thread_id2addr empty_heap allocate typeof_addr heap_write allocated h.J_known_addrs final_expr (\<lambda>t ((e, l), h) ta ((e', l'), h'). h.red (extTA2J P) P t e (h, l) ta e' (h', l')) (\<lambda>t x h. \<exists>ET. h.sconf_type_ok ET t x h) P
[PROOF STEP]
interpret known_addrs_typing
    addr2thread_id thread_id2addr
    spurious_wakeups
    empty_heap allocate "\<lambda>_. typeof_addr" heap_read heap_write
    allocated h.J_known_addrs
    final_expr "h.mred P" "\<lambda>t x h. \<exists>ET. h.sconf_type_ok ET t x h"
    P
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. known_addrs_typing addr2thread_id thread_id2addr empty_heap allocate (\<lambda>_. typeof_addr) heap_write allocated h.J_known_addrs final_expr (\<lambda>t ((e, l), h) ta ((e', l'), h'). h.red (extTA2J P) P t e (h, l) ta e' (h', l')) (\<lambda>t x h. \<exists>ET. h.sconf_type_ok ET t x h) P
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
wf_J_prog P
h.start_heap_ok

goal (1 subgoal):
 1. known_addrs_typing addr2thread_id thread_id2addr empty_heap allocate (\<lambda>_. typeof_addr) heap_write allocated h.J_known_addrs final_expr (\<lambda>t ((e, l), h) ta ((e', l'), h'). h.red (extTA2J P) P t e (h, l) ta e' (h', l')) (\<lambda>t x h. \<exists>ET. h.sconf_type_ok ET t x h) P
[PROOF STEP]
by(rule h.mred_known_addrs_typing)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. known_addrs_typing' addr2thread_id thread_id2addr empty_heap allocate typeof_addr heap_write allocated h.J_known_addrs final_expr (\<lambda>t ((e, l), h) ta ((e', l'), h'). h.red (extTA2J P) P t e (h, l) ta e' (h', l')) (\<lambda>t x h. \<exists>ET. h.sconf_type_ok ET t x h) P
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. known_addrs_typing' addr2thread_id thread_id2addr empty_heap allocate typeof_addr heap_write allocated h.J_known_addrs final_expr (\<lambda>t ((e, l), h) ta ((e', l'), h'). h.red (extTA2J P) P t e (h, l) ta e' (h', l')) (\<lambda>t x h. \<exists>ET. h.sconf_type_ok ET t x h) P
[PROOF STEP]
by unfold_locales(auto dest: red_New_type_match)
[PROOF STATE]
proof (state)
this:
known_addrs_typing' addr2thread_id thread_id2addr empty_heap allocate typeof_addr heap_write allocated h.J_known_addrs final_expr (\<lambda>t ((e, l), h) ta ((e', l'), h'). h.red (extTA2J P) P t e (h, l) ta e' (h', l')) (\<lambda>t x h. \<exists>ET. h.sconf_type_ok ET t x h) P

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "P D"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P D
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P D
[PROOF STEP]
oops


[STATEMENT]
lemma approximating_imp_booloan_semantics_nospoofing:
      assumes "matcher_agree_on_exact_matches \<gamma> common_matcher"
      and "simple_ruleset rs"
      and no_spoofing: "no_spoofing TYPE('pkt_ext) ipassmt rs"
      shows "\<forall> iface \<in> dom ipassmt. \<forall>p::('i::len,'pkt_ext) tagged_packet_scheme.
                (\<Gamma>,\<gamma>,p\<lparr>p_iiface:=iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow) \<longrightarrow>
                    p_src p \<in> (ipcidr_union_set (set (the (ipassmt iface))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>iface\<in>dom ipassmt. \<forall>p. \<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow \<longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
[PROOF STEP]
unfolding no_spoofing_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>iface\<in>dom ipassmt. \<forall>p. \<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow \<longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
[PROOF STEP]
proof(intro ballI allI impI)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>iface p. \<lbrakk>iface \<in> dom ipassmt; \<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow\<rbrakk> \<Longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
[PROOF STEP]
fix iface p
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>iface p. \<lbrakk>iface \<in> dom ipassmt; \<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow\<rbrakk> \<Longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
[PROOF STEP]
assume i: "iface \<in> dom ipassmt"
           and a: "\<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow"
[PROOF STATE]
proof (state)
this:
iface \<in> dom ipassmt
\<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow

goal (1 subgoal):
 1. \<And>iface p. \<lbrakk>iface \<in> dom ipassmt; \<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow\<rbrakk> \<Longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
[PROOF STEP]
from no_spoofing[unfolded no_spoofing_def] i
[PROOF STATE]
proof (chain)
picking this:
\<forall>iface\<in>dom ipassmt. \<forall>p. (common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow \<longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
iface \<in> dom ipassmt
[PROOF STEP]
have no_spoofing':
          "(common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow \<longrightarrow>
           p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))"
[PROOF STATE]
proof (prove)
using this:
\<forall>iface\<in>dom ipassmt. \<forall>p. (common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow \<longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
iface \<in> dom ipassmt

goal (1 subgoal):
 1. (common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow \<longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow \<longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))

goal (1 subgoal):
 1. \<And>iface p. \<lbrakk>iface \<in> dom ipassmt; \<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow\<rbrakk> \<Longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
[PROOF STEP]
from assms simple_imp_good_ruleset FinalAllows_subseteq_in_doubt_allow[where rs=rs]
[PROOF STATE]
proof (chain)
picking this:
matcher_agree_on_exact_matches \<gamma> common_matcher
simple_ruleset rs
no_spoofing TYPE('pkt_ext) ipassmt rs
simple_ruleset ?rs \<Longrightarrow> good_ruleset ?rs
\<lbrakk>matcher_agree_on_exact_matches ?\<gamma> ?\<beta>; good_ruleset rs\<rbrakk> \<Longrightarrow> _Collect p (?\<Gamma>,?\<gamma>,p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow) \<subseteq> _Collect p ((?\<beta>, in_doubt_allow),p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow)
[PROOF STEP]
have
          "{p. \<Gamma>,\<gamma>,p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow} \<subseteq> {p. (common_matcher, in_doubt_allow),p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow}"
[PROOF STATE]
proof (prove)
using this:
matcher_agree_on_exact_matches \<gamma> common_matcher
simple_ruleset rs
no_spoofing TYPE('pkt_ext) ipassmt rs
simple_ruleset ?rs \<Longrightarrow> good_ruleset ?rs
\<lbrakk>matcher_agree_on_exact_matches ?\<gamma> ?\<beta>; good_ruleset rs\<rbrakk> \<Longrightarrow> _Collect p (?\<Gamma>,?\<gamma>,p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow) \<subseteq> _Collect p ((?\<beta>, in_doubt_allow),p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow)

goal (1 subgoal):
 1. _Collect p (\<Gamma>,\<gamma>,p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow) \<subseteq> _Collect p ((common_matcher, in_doubt_allow),p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
_Collect p (\<Gamma>,\<gamma>,p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow) \<subseteq> _Collect p ((common_matcher, in_doubt_allow),p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow)

goal (1 subgoal):
 1. \<And>iface p. \<lbrakk>iface \<in> dom ipassmt; \<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow\<rbrakk> \<Longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
[PROOF STEP]
with a
[PROOF STATE]
proof (chain)
picking this:
\<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow
_Collect p (\<Gamma>,\<gamma>,p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow) \<subseteq> _Collect p ((common_matcher, in_doubt_allow),p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow)
[PROOF STEP]
have "(common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow"
[PROOF STATE]
proof (prove)
using this:
\<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow
_Collect p (\<Gamma>,\<gamma>,p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow) \<subseteq> _Collect p ((common_matcher, in_doubt_allow),p\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow)

goal (1 subgoal):
 1. (common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow

goal (1 subgoal):
 1. \<And>iface p. \<lbrakk>iface \<in> dom ipassmt; \<Gamma>,\<gamma>,p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow> Decision FinalAllow\<rbrakk> \<Longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
[PROOF STEP]
with no_spoofing'
[PROOF STATE]
proof (chain)
picking this:
(common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow \<longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
(common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow
[PROOF STEP]
show "p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))"
[PROOF STATE]
proof (prove)
using this:
(common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow \<longrightarrow> p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
(common_matcher, in_doubt_allow),p\<lparr>p_iiface := iface_sel iface\<rparr>\<turnstile> \<langle>rs, Undecided\<rangle> \<Rightarrow>\<^sub>\<alpha> Decision FinalAllow

goal (1 subgoal):
 1. p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
p_src p \<in> ipcidr_union_set (set (the (ipassmt iface)))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "P (x::BitList)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P x
[PROOF STEP]
refute [expect = potential]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P x
[PROOF STEP]
oops


[STATEMENT]
lemma "P (snd x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (snd x)
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (snd x)
[PROOF STEP]
oops


[STATEMENT]
lemma par_rreq_rrep_sn_quality_increases:
  "opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>)
                            globala (\<lambda>(\<sigma>, _, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
have "opaodv i \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>)
                globala (\<lambda>(\<sigma>, _, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. opaodv i \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
by (rule ostep_invariant_weakenE [OF olocal_quality_increases])
         (auto dest!: onllD seqllD elim!: aodv_ex_labelE)
[PROOF STATE]
proof (state)
this:
opaodv i \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))

goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
hence "opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>)
                                   globala (\<lambda>(\<sigma>, _, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))"
[PROOF STATE]
proof (prove)
using this:
opaodv i \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))

goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
by (rule lift_step_into_qmsg_statelessassm) simp_all
[PROOF STATE]
proof (state)
this:
opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))

goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))

goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
by rule auto
[PROOF STATE]
proof (state)
this:
opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma preallocated_field_update:
  "\<lbrakk> map_of (fields (G, oT)) X = Some T; hp a = Some(oT,fs);
     G\<turnstile>h hp\<surd>; preallocated hp \<rbrakk>
  \<Longrightarrow> preallocated (hp(a \<mapsto> (oT, fs(X\<mapsto>v))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>map_of (fields (G, oT)) X = Some T; hp a = Some (oT, fs); G \<turnstile>h hp \<surd>; preallocated hp\<rbrakk> \<Longrightarrow> preallocated (hp(a \<mapsto> (oT, fs(X \<mapsto> v))))
[PROOF STEP]
apply (unfold preallocated_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>map_of (fields (G, oT)) X = Some T; hp a = Some (oT, fs); G \<turnstile>h hp \<surd>; \<forall>x. \<exists>fs. hp (XcptRef x) = Some (Xcpt x, fs)\<rbrakk> \<Longrightarrow> \<forall>x. \<exists>fsa. (hp(a \<mapsto> (oT, fs(X \<mapsto> v)))) (XcptRef x) = Some (Xcpt x, fsa)
[PROOF STEP]
apply (rule allI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>map_of (fields (G, oT)) X = Some T; hp a = Some (oT, fs); G \<turnstile>h hp \<surd>; \<forall>x. \<exists>fs. hp (XcptRef x) = Some (Xcpt x, fs)\<rbrakk> \<Longrightarrow> \<exists>fsa. (hp(a \<mapsto> (oT, fs(X \<mapsto> v)))) (XcptRef x) = Some (Xcpt x, fsa)
[PROOF STEP]
apply (erule_tac x=x in allE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>map_of (fields (G, oT)) X = Some T; hp a = Some (oT, fs); G \<turnstile>h hp \<surd>; \<exists>fs. hp (XcptRef x) = Some (Xcpt x, fs)\<rbrakk> \<Longrightarrow> \<exists>fsa. (hp(a \<mapsto> (oT, fs(X \<mapsto> v)))) (XcptRef x) = Some (Xcpt x, fsa)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>map_of (fields (G, oT)) X = Some T; hp a = Some (oT, fs); G \<turnstile>h hp \<surd>; \<exists>fs. hp (XcptRef x) = Some (Xcpt x, fs)\<rbrakk> \<Longrightarrow> XcptRef x = a \<longrightarrow> oT = Xcpt x
[PROOF STEP]
apply (rule ccontr)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>map_of (fields (G, oT)) X = Some T; hp a = Some (oT, fs); G \<turnstile>h hp \<surd>; \<exists>fs. hp (XcptRef x) = Some (Xcpt x, fs); \<not> (XcptRef x = a \<longrightarrow> oT = Xcpt x)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (unfold hconf_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>map_of (fields (G, oT)) X = Some T; hp a = Some (oT, fs); \<forall>a obj. hp a = Some obj \<longrightarrow> G,hp \<turnstile> obj \<surd>; \<exists>fs. hp (XcptRef x) = Some (Xcpt x, fs); \<not> (XcptRef x = a \<longrightarrow> oT = Xcpt x)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (erule allE, erule allE, erule impE, assumption)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>map_of (fields (G, oT)) X = Some T; hp a = Some (oT, fs); \<exists>fs. hp (XcptRef x) = Some (Xcpt x, fs); \<not> (XcptRef x = a \<longrightarrow> oT = Xcpt x); G,hp \<turnstile> (oT, fs) \<surd>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (unfold oconf_def lconf_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>map_of (fields (G, oT)) X = Some T; hp a = Some (oT, fs); \<exists>fs. hp (XcptRef x) = Some (Xcpt x, fs); \<not> (XcptRef x = a \<longrightarrow> oT = Xcpt x); \<forall>n T. map_of (fields (G, fst (oT, fs))) n = Some T \<longrightarrow> (\<exists>v. snd (oT, fs) n = Some v \<and> G,hp \<turnstile> v ::\<preceq> T)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (simp del: split_paired_All)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma RefRel_HighBranch_secure_refinement:
  "secure_refinement A.R RefRel_HighBranch rel_inv\<^sub>C"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. secure_refinement A.R RefRel_HighBranch rel_inv\<^sub>C
[PROOF STEP]
apply(unfold secure_refinement_def2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. closed_others RefRel_HighBranch \<and> preserves_modes_mem RefRel_HighBranch \<and> new_vars_private RefRel_HighBranch \<and> C.closed_glob_consistent rel_inv\<^sub>C \<and> (\<forall>c\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>n c\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<forall>c\<^sub>2\<^sub>A c\<^sub>2\<^sub>C mem\<^sub>2\<^sub>C c\<^sub>2\<^sub>A' mem\<^sub>2\<^sub>A'. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> A.R \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C \<and> A.neval \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A \<longrightarrow> (\<exists>c\<^sub>2\<^sub>C' mem\<^sub>2\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C \<and> (\<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C)))))
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. closed_others RefRel_HighBranch
 2. preserves_modes_mem RefRel_HighBranch \<and> new_vars_private RefRel_HighBranch \<and> C.closed_glob_consistent rel_inv\<^sub>C \<and> (\<forall>c\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>n c\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<forall>c\<^sub>2\<^sub>A c\<^sub>2\<^sub>C mem\<^sub>2\<^sub>C c\<^sub>2\<^sub>A' mem\<^sub>2\<^sub>A'. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> A.R \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C \<and> A.neval \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A \<longrightarrow> (\<exists>c\<^sub>2\<^sub>C' mem\<^sub>2\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C \<and> (\<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C)))))
[PROOF STEP]
apply(rule closed_others_RefRel_HighBranch)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_modes_mem RefRel_HighBranch \<and> new_vars_private RefRel_HighBranch \<and> C.closed_glob_consistent rel_inv\<^sub>C \<and> (\<forall>c\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>n c\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<forall>c\<^sub>2\<^sub>A c\<^sub>2\<^sub>C mem\<^sub>2\<^sub>C c\<^sub>2\<^sub>A' mem\<^sub>2\<^sub>A'. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> A.R \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C \<and> A.neval \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A \<longrightarrow> (\<exists>c\<^sub>2\<^sub>C' mem\<^sub>2\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C \<and> (\<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C)))))
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. preserves_modes_mem RefRel_HighBranch
 2. new_vars_private RefRel_HighBranch \<and> C.closed_glob_consistent rel_inv\<^sub>C \<and> (\<forall>c\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>n c\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<forall>c\<^sub>2\<^sub>A c\<^sub>2\<^sub>C mem\<^sub>2\<^sub>C c\<^sub>2\<^sub>A' mem\<^sub>2\<^sub>A'. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> A.R \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C \<and> A.neval \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A \<longrightarrow> (\<exists>c\<^sub>2\<^sub>C' mem\<^sub>2\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C \<and> (\<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C)))))
[PROOF STEP]
apply(rule preserves_modes_mem_RefRel_HighBranch)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. new_vars_private RefRel_HighBranch \<and> C.closed_glob_consistent rel_inv\<^sub>C \<and> (\<forall>c\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>n c\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<forall>c\<^sub>2\<^sub>A c\<^sub>2\<^sub>C mem\<^sub>2\<^sub>C c\<^sub>2\<^sub>A' mem\<^sub>2\<^sub>A'. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> A.R \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C \<and> A.neval \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A \<longrightarrow> (\<exists>c\<^sub>2\<^sub>C' mem\<^sub>2\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C \<and> (\<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C)))))
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. new_vars_private RefRel_HighBranch
 2. C.closed_glob_consistent rel_inv\<^sub>C \<and> (\<forall>c\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>n c\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<forall>c\<^sub>2\<^sub>A c\<^sub>2\<^sub>C mem\<^sub>2\<^sub>C c\<^sub>2\<^sub>A' mem\<^sub>2\<^sub>A'. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> A.R \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C \<and> A.neval \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A \<longrightarrow> (\<exists>c\<^sub>2\<^sub>C' mem\<^sub>2\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C \<and> (\<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C)))))
[PROOF STEP]
apply(rule new_vars_private_RefRel_HighBranch)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. C.closed_glob_consistent rel_inv\<^sub>C \<and> (\<forall>c\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>n c\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<forall>c\<^sub>2\<^sub>A c\<^sub>2\<^sub>C mem\<^sub>2\<^sub>C c\<^sub>2\<^sub>A' mem\<^sub>2\<^sub>A'. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> A.R \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C \<and> A.neval \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A \<longrightarrow> (\<exists>c\<^sub>2\<^sub>C' mem\<^sub>2\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C \<and> (\<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C)))))
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. C.closed_glob_consistent rel_inv\<^sub>C
 2. \<forall>c\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>n c\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<forall>c\<^sub>2\<^sub>A c\<^sub>2\<^sub>C mem\<^sub>2\<^sub>C c\<^sub>2\<^sub>A' mem\<^sub>2\<^sub>A'. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> A.R \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C \<and> A.neval \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A \<longrightarrow> (\<exists>c\<^sub>2\<^sub>C' mem\<^sub>2\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C \<and> (\<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C))))
[PROOF STEP]
apply(rule rel_inv\<^sub>C_closed_glob_consistent)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>c\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>n c\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<forall>c\<^sub>2\<^sub>A c\<^sub>2\<^sub>C mem\<^sub>2\<^sub>C c\<^sub>2\<^sub>A' mem\<^sub>2\<^sub>A'. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> A.R \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C \<and> A.neval \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A \<longrightarrow> (\<exists>c\<^sub>2\<^sub>C' mem\<^sub>2\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C \<and> (\<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C))))
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>c\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. \<lbrakk>(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch; eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C\<rbrakk> \<Longrightarrow> \<exists>n c\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>A_of mem\<^sub>1\<^sub>C'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<forall>c\<^sub>2\<^sub>A c\<^sub>2\<^sub>C mem\<^sub>2\<^sub>C c\<^sub>2\<^sub>A' mem\<^sub>2\<^sub>A'. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>1\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A) \<in> A.R \<and> (\<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C \<and> A.neval \<langle>c\<^sub>2\<^sub>A, mds\<^sub>A_of mds\<^sub>C, mem\<^sub>A_of mem\<^sub>2\<^sub>C\<rangle>\<^sub>A n \<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A \<longrightarrow> (\<exists>c\<^sub>2\<^sub>C' mem\<^sub>2\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>2\<^sub>C, mds\<^sub>C, mem\<^sub>2\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C \<and> (\<langle>c\<^sub>2\<^sub>A', mds\<^sub>A_of mds\<^sub>C', mem\<^sub>2\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> RefRel_HighBranch \<and> (\<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C, \<langle>c\<^sub>2\<^sub>C', mds\<^sub>C', mem\<^sub>2\<^sub>C'\<rangle>\<^sub>C) \<in> rel_inv\<^sub>C))
[PROOF STEP]
apply(rule induction_full_RefRel_HighBranch, simp+)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "\<And>f x::'a af. f \<diamondop> x = x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f x. f \<diamondop> x = x
[PROOF STEP]
apply applicative_nf
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f. pure (\<lambda>x. x) \<diamondop> f = pure (\<lambda>x. x)
[PROOF STEP]
oops