[STATEMENT]
lemma new_character_data_type_wf_preserved [simp]:
  "h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<Longrightarrow> CharacterDataClass.type_wf h = CharacterDataClass.type_wf h'
[PROOF STEP]
apply(auto simp add: new_character_data_def new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def Let_def put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
      elim!: bind_returns_heap_E type_wf_put_ptr_not_in_heap_E
      intro!: type_wf_put_I ElementMonad.type_wf_put_I NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I
      split: if_splits)[1]
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ElementClass.type_wf h
 2. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> NodeClass.type_wf h
 3. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> ObjectClass.type_wf h
 4. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; CharacterDataClass.type_wf h\<rbrakk> \<Longrightarrow> is_node_kind (cast (cast (create_character_data_obj [])))
 5. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h))) |\<in>| character_data_ptr_kinds h\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply(simp_all add: type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs is_node_kind_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>h' = put (cast (cast (character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h)))))) (cast (cast (create_character_data_obj []))) h; character_data_ptr.Ref (Suc (fMax (character_data_ptr.the_ref |`| character_data_ptrs h))) |\<in>| character_data_ptr_kinds h\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
by (meson new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def new\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_ptr_not_in_heap)


[STATEMENT]
lemma OclExcluding_inv: "(x:: Set('b::{null})) \<noteq> \<bottom> \<Longrightarrow> x \<noteq> null \<Longrightarrow>  y \<noteq> \<bottom>  \<Longrightarrow>
           \<lfloor>\<lfloor>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e x\<rceil>\<rceil> - {y}\<rfloor>\<rfloor> \<in> {X. X = bot \<or> X = null \<or> (\<forall>x\<in>\<lceil>\<lceil>X\<rceil>\<rceil>. x \<noteq> bot)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<noteq> \<bottom>; x \<noteq> null; y \<noteq> \<bottom>\<rbrakk> \<Longrightarrow> \<lfloor>\<lfloor>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e x\<rceil>\<rceil> - {y}\<rfloor>\<rfloor> \<in> {X. X = \<bottom> \<or> X = null \<or> (\<forall>x\<in>\<lceil>\<lceil>X\<rceil>\<rceil>. x \<noteq> \<bottom>)}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>x \<noteq> \<bottom>; x \<noteq> null; y \<noteq> \<bottom>\<rbrakk> \<Longrightarrow> \<lfloor>\<lfloor>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e x\<rceil>\<rceil> - {y}\<rfloor>\<rfloor> \<in> {X. X = \<bottom> \<or> X = null \<or> (\<forall>x\<in>\<lceil>\<lceil>X\<rceil>\<rceil>. x \<noteq> \<bottom>)}
[PROOF STEP]
fix X :: "'a state \<times> 'a state \<Rightarrow> Set('b)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>x \<noteq> \<bottom>; x \<noteq> null; y \<noteq> \<bottom>\<rbrakk> \<Longrightarrow> \<lfloor>\<lfloor>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e x\<rceil>\<rceil> - {y}\<rfloor>\<rfloor> \<in> {X. X = \<bottom> \<or> X = null \<or> (\<forall>x\<in>\<lceil>\<lceil>X\<rceil>\<rceil>. x \<noteq> \<bottom>)}
[PROOF STEP]
fix \<tau>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>x \<noteq> \<bottom>; x \<noteq> null; y \<noteq> \<bottom>\<rbrakk> \<Longrightarrow> \<lfloor>\<lfloor>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e x\<rceil>\<rceil> - {y}\<rfloor>\<rfloor> \<in> {X. X = \<bottom> \<or> X = null \<or> (\<forall>x\<in>\<lceil>\<lceil>X\<rceil>\<rceil>. x \<noteq> \<bottom>)}
[PROOF STEP]
show "x \<noteq> \<bottom> \<Longrightarrow> x \<noteq> null \<Longrightarrow> y \<noteq> \<bottom> \<Longrightarrow> ?thesis"
            when "x = X \<tau>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<noteq> \<bottom>; x \<noteq> null; y \<noteq> \<bottom>\<rbrakk> \<Longrightarrow> \<lfloor>\<lfloor>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e x\<rceil>\<rceil> - {y}\<rfloor>\<rfloor> \<in> {X. X = \<bottom> \<or> X = null \<or> (\<forall>x\<in>\<lceil>\<lceil>X\<rceil>\<rceil>. x \<noteq> \<bottom>)}
[PROOF STEP]
by(simp add: that Set_inv_lemma[simplified OclValid_def
                                          defined_def null_fun_def bot_fun_def, of X \<tau>])
[PROOF STATE]
proof (state)
this:
\<lbrakk>x = X \<tau>; x \<noteq> \<bottom>; x \<noteq> null; y \<noteq> \<bottom>\<rbrakk> \<Longrightarrow> \<lfloor>\<lfloor>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e x\<rceil>\<rceil> - {y}\<rfloor>\<rfloor> \<in> {X. X = \<bottom> \<or> X = null \<or> (\<forall>x\<in>\<lceil>\<lceil>X\<rceil>\<rceil>. x \<noteq> \<bottom>)}

goal (1 subgoal):
 1. \<lbrakk>x \<noteq> \<bottom>; x \<noteq> null; y \<noteq> \<bottom>\<rbrakk> \<Longrightarrow> x = ?X3 ?\<tau>3
[PROOF STEP]
qed simp_all


[STATEMENT]
lemma "x = (y::unit one_or_two)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = y
[PROOF STEP]
nitpick [expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = y
[PROOF STEP]
sorry


[STATEMENT]
lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_attrs_type_wf_preserved [simp]:
  "h \<turnstile> put_M element_ptr attrs_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h \<turnstile> put_M element_ptr attrs_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> ElementClass.type_wf h = ElementClass.type_wf h'
[PROOF STEP]
apply(auto simp add: type_wf_defs NodeClass.type_wf_defs ObjectClass.type_wf_defs  Let_def
      put_M_defs get_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def
      get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def
      split: prod.splits option.splits Option.bind_splits elim!: bind_returns_heap_E)[1]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x2 node_ptr va. \<lbrakk>h' = Heap (fmupd (cast (cast element_ptr)) (cast (cast (x2\<lparr>attrs := v\<rparr>))) (the_heap h)); fmlookup (the_heap h) (cast (cast element_ptr)) = Some (cast (cast x2)); \<forall>node_ptr\<in>fset (node_ptr_kinds h). (fmlookup (the_heap h) (cast node_ptr) = None \<longrightarrow> cast element_ptr = node_ptr) \<and> (\<forall>v. fmlookup (the_heap h) (cast node_ptr) = Some v \<longrightarrow> cast element_ptr \<noteq> node_ptr \<longrightarrow> (\<exists>y. cast y = v)); \<forall>element_ptra\<in>fset (element_ptr_kinds h). (fmlookup (the_heap h) (cast (cast element_ptra)) = None \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>v. ((\<forall>node. cast node \<noteq> v) \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>va. cast va = v \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr \<noteq> element_ptra \<longrightarrow> (\<exists>y. cast y = va))); node_ptr |\<in>| node_ptr_kinds h; fmlookup (the_heap h) (cast node_ptr) = Some va\<rbrakk> \<Longrightarrow> \<exists>y. cast y = va
 2. \<And>x2 element_ptra va. \<lbrakk>h' = Heap (fmupd (cast (cast element_ptr)) (cast (cast (x2\<lparr>attrs := v\<rparr>))) (the_heap h)); fmlookup (the_heap h) (cast (cast element_ptr)) = Some (cast (cast x2)); \<forall>node_ptr\<in>fset (node_ptr_kinds h). (fmlookup (the_heap h) (cast node_ptr) = None \<longrightarrow> cast element_ptr = node_ptr) \<and> (\<forall>v. fmlookup (the_heap h) (cast node_ptr) = Some v \<longrightarrow> cast element_ptr \<noteq> node_ptr \<longrightarrow> (\<exists>y. cast y = v)); \<forall>element_ptra\<in>fset (element_ptr_kinds h). (fmlookup (the_heap h) (cast (cast element_ptra)) = None \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>v. ((\<forall>node. cast node \<noteq> v) \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>va. cast va = v \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr \<noteq> element_ptra \<longrightarrow> (\<exists>y. cast y = va))); element_ptra |\<in>| element_ptr_kinds h; fmlookup (the_heap h) (cast (cast element_ptra)) = Some (cast va)\<rbrakk> \<Longrightarrow> \<exists>y. cast y = va
[PROOF STEP]
apply (metis finite_set_in option.inject)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x2 element_ptra va. \<lbrakk>h' = Heap (fmupd (cast (cast element_ptr)) (cast (cast (x2\<lparr>attrs := v\<rparr>))) (the_heap h)); fmlookup (the_heap h) (cast (cast element_ptr)) = Some (cast (cast x2)); \<forall>node_ptr\<in>fset (node_ptr_kinds h). (fmlookup (the_heap h) (cast node_ptr) = None \<longrightarrow> cast element_ptr = node_ptr) \<and> (\<forall>v. fmlookup (the_heap h) (cast node_ptr) = Some v \<longrightarrow> cast element_ptr \<noteq> node_ptr \<longrightarrow> (\<exists>y. cast y = v)); \<forall>element_ptra\<in>fset (element_ptr_kinds h). (fmlookup (the_heap h) (cast (cast element_ptra)) = None \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>v. ((\<forall>node. cast node \<noteq> v) \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>va. cast va = v \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr \<noteq> element_ptra \<longrightarrow> (\<exists>y. cast y = va))); element_ptra |\<in>| element_ptr_kinds h; fmlookup (the_heap h) (cast (cast element_ptra)) = Some (cast va)\<rbrakk> \<Longrightarrow> \<exists>y. cast y = va
[PROOF STEP]
apply (metis cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inv finite_set_in option.sel)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma OclANY_singleton_exec[simp,code_unfold]:
      "(Set{}->including\<^sub>S\<^sub>e\<^sub>t(a))->any\<^sub>S\<^sub>e\<^sub>t() = a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Set{a}->any\<^sub>S\<^sub>e\<^sub>t() = a
[PROOF STEP]
apply(rule ext, rename_tac \<tau>, simp add: mtSet_def OclANY_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<tau>. ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(case_tac "\<tau> \<Turnstile> \<upsilon> a")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>\<tau>. \<tau> \<Turnstile> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
 2. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(simp add: OclValid_def mtSet_defined[simplified mtSet_def]
                  mtSet_valid[simplified mtSet_def] mtSet_rep_set[simplified mtSet_def])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> ((\<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> null \<tau> = a \<tau>)
 2. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(subst (1 2) cp_OclAnd,
        subst (1 2) OclNotEmpty_including[where X = "Set{}", simplified mtSet_def])
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>\<tau> _. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> \<tau> \<Turnstile> \<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)
 2. \<And>\<tau> _. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> finite \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)\<rceil>\<rceil>
 3. \<And>\<tau> _. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> \<tau> \<Turnstile> \<upsilon> a
 4. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> (((\<lambda>_. (\<upsilon> a) \<tau>) and (\<lambda>_. true \<tau>)) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> (((\<lambda>_. (\<upsilon> a) \<tau>) and (\<lambda>_. true \<tau>)) \<tau> \<noteq> true \<tau> \<longrightarrow> null \<tau> = a \<tau>)
 5. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(simp add: mtSet_defined[simplified mtSet_def])
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>\<tau> _. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> finite \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)\<rceil>\<rceil>
 2. \<And>\<tau> _. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> \<tau> \<Turnstile> \<upsilon> a
 3. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> (((\<lambda>_. (\<upsilon> a) \<tau>) and (\<lambda>_. true \<tau>)) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> (((\<lambda>_. (\<upsilon> a) \<tau>) and (\<lambda>_. true \<tau>)) \<tau> \<noteq> true \<tau> \<longrightarrow> null \<tau> = a \<tau>)
 4. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(metis (opaque_lifting, no_types) finite.emptyI mtSet_def mtSet_rep_set)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>\<tau> _. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> \<tau> \<Turnstile> \<upsilon> a
 2. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> (((\<lambda>_. (\<upsilon> a) \<tau>) and (\<lambda>_. true \<tau>)) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> (((\<lambda>_. (\<upsilon> a) \<tau>) and (\<lambda>_. true \<tau>)) \<tau> \<noteq> true \<tau> \<longrightarrow> null \<tau> = a \<tau>)
 3. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(simp add: OclValid_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> (((\<lambda>_. (\<upsilon> a) \<tau>) and (\<lambda>_. true \<tau>)) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> (((\<lambda>_. (\<upsilon> a) \<tau>) and (\<lambda>_. true \<tau>)) \<tau> \<noteq> true \<tau> \<longrightarrow> null \<tau> = a \<tau>)
 2. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(simp add: OclIncluding_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>insert (a \<tau>) \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)\<rceil>\<rceil>\<rfloor>\<rfloor>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)) \<tau> \<noteq> true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (invalid \<tau>)\<rceil>\<rceil>) = a \<tau>)
 2. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> (\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>insert (a \<tau>) \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)\<rceil>\<rceil>\<rfloor>\<rfloor>)\<rceil>\<rceil>) = a \<tau>
 2. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> (\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)) \<tau> \<noteq> true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (invalid \<tau>)\<rceil>\<rceil>) = a \<tau>
 3. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(subst (1 2) Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e_inverse, simp add: bot_option_def null_option_def)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>\<tau> y. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> \<lfloor>\<lfloor>insert (a \<tau>) \<lceil>\<lceil>\<lfloor>\<lfloor>{}\<rfloor>\<rfloor>\<rceil>\<rceil>\<rfloor>\<rfloor> \<in> {X. X = \<bottom> \<or> X = null \<or> (\<forall>x\<in>\<lceil>\<lceil>X\<rceil>\<rceil>. x \<noteq> \<bottom>)}
 2. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> (\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>\<lfloor>\<lfloor>insert (a \<tau>) \<lceil>\<lceil>\<lfloor>\<lfloor>{}\<rfloor>\<rfloor>\<rceil>\<rceil>\<rfloor>\<rfloor>\<rceil>\<rceil>) = a \<tau>
 3. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> (\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)) \<tau> \<noteq> true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (invalid \<tau>)\<rceil>\<rceil>) = a \<tau>
 4. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(simp, metis OclValid_def foundation18')
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> (\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>\<lfloor>\<lfloor>insert (a \<tau>) \<lceil>\<lceil>\<lfloor>\<lfloor>{}\<rfloor>\<rfloor>\<rceil>\<rceil>\<rfloor>\<rfloor>\<rceil>\<rceil>) = a \<tau>
 2. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> (\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)) \<tau> \<noteq> true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (invalid \<tau>)\<rceil>\<rceil>) = a \<tau>
 3. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>\<tau>. (\<upsilon> a) \<tau> = true \<tau> \<Longrightarrow> (\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>)) \<tau> \<noteq> true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (invalid \<tau>)\<rceil>\<rceil>) = a \<tau>
 2. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(simp add: mtSet_defined[simplified mtSet_def])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
(* *)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(subgoal_tac "a \<tau> = \<bottom>")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>\<tau>. \<lbrakk>\<tau> |\<noteq> \<upsilon> a; a \<tau> = \<bottom>\<rbrakk> \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
 2. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> a \<tau> = \<bottom>
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>\<tau>. \<tau> |\<noteq> \<upsilon> a \<Longrightarrow> a \<tau> = \<bottom>
 2. \<And>\<tau>. \<lbrakk>\<tau> |\<noteq> \<upsilon> a; a \<tau> = \<bottom>\<rbrakk> \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(simp add: OclValid_def valid_def bot_fun_def split: if_split_asm)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<tau>. \<lbrakk>\<tau> |\<noteq> \<upsilon> a; a \<tau> = \<bottom>\<rbrakk> \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>)) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = a \<tau>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> \<noteq> true \<tau> \<longrightarrow> \<bottom> = a \<tau>))
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<tau>. \<lbrakk>\<tau> |\<noteq> \<upsilon> a; a \<tau> = \<bottom>\<rbrakk> \<Longrightarrow> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> = true \<tau> \<longrightarrow> (\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = \<bottom>) \<and> ((\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a and \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t()) \<tau> \<noteq> true \<tau> \<longrightarrow> (\<delta> (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>) and \<upsilon> a) \<tau> = true \<tau> \<longrightarrow> null \<tau> = \<bottom>)
[PROOF STEP]
apply(subst (1 2 3 4) cp_OclAnd,
       simp add: mtSet_defined[simplified mtSet_def] valid_def bot_fun_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<tau>. \<lbrakk>\<tau> |\<noteq> \<lambda>\<tau>. if a \<tau> = \<bottom> then false \<tau> else true \<tau>; a \<tau> = \<bottom>\<rbrakk> \<Longrightarrow> (((\<lambda>_. false \<tau>) and (\<lambda>_. \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t() \<tau>)) \<tau> = true \<tau> \<longrightarrow> ((\<lambda>_. true \<tau>) and (\<lambda>_. false \<tau>)) \<tau> = true \<tau> \<longrightarrow> (SOME y. y \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (\<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a) \<tau>)\<rceil>\<rceil>) = \<bottom>) \<and> (((\<lambda>_. false \<tau>) and (\<lambda>_. \<lambda>\<tau>. Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>{}\<rfloor>\<rfloor>->including\<^sub>S\<^sub>e\<^sub>t(a)->notEmpty\<^sub>S\<^sub>e\<^sub>t() \<tau>)) \<tau> \<noteq> true \<tau> \<longrightarrow> ((\<lambda>_. true \<tau>) and (\<lambda>_. false \<tau>)) \<tau> = true \<tau> \<longrightarrow> null \<tau> = \<bottom>)
[PROOF STEP]
by(simp add: cp_OclAnd[symmetric], rule impI, simp add: false_def true_def)


[STATEMENT]
lemma "CoPw \<eta> \<Longrightarrow> CoP2 \<eta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. CoPw \<eta> \<Longrightarrow> CoP2 \<eta>
[PROOF STEP]
nitpick
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. CoPw \<eta> \<Longrightarrow> CoP2 \<eta>
[PROOF STEP]
oops


[STATEMENT]
theorem eqOn_FV_sem:
assumes "wff \<phi>" and "pointerOf \<pi>l = pointerOf \<pi>l1"
and "cpt (FV \<phi>) env \<pi>l" and "cpt (FV \<phi>) env1 \<pi>l1" and "eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1"
shows "sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
wff \<phi>
pointerOf \<pi>l = pointerOf \<pi>l1
cpt (FV \<phi>) env \<pi>l
cpt (FV \<phi>) env1 \<pi>l1
local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1

goal (1 subgoal):
 1. sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1
[PROOF STEP]
proof (induction \<phi> arbitrary: env \<pi>l env1 \<pi>l1)
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>x1 x2 env \<pi>l env1 \<pi>l1. \<lbrakk>wff (Atom x1 x2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Atom x1 x2)) env \<pi>l; cpt (FV (Atom x1 x2)) env1 \<pi>l1; local.eqOn (FV (Atom x1 x2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Atom x1 x2) env \<pi>l = sem (Atom x1 x2) env1 \<pi>l1
 2. \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff Fls; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV Fls) env \<pi>l; cpt (FV Fls) env1 \<pi>l1; local.eqOn (FV Fls) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem Fls env \<pi>l = sem Fls env1 \<pi>l1
 3. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Neg \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Neg \<phi>)) env \<pi>l; cpt (FV (Neg \<phi>)) env1 \<pi>l1; local.eqOn (FV (Neg \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Neg \<phi>) env \<pi>l = sem (Neg \<phi>) env1 \<pi>l1
 4. \<And>\<phi>1 \<phi>2 env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>1; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>1) env \<pi>l; cpt (FV \<phi>1) env1 \<pi>l1; local.eqOn (FV \<phi>1) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>1 env \<pi>l = sem \<phi>1 env1 \<pi>l1; \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>2; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>2) env \<pi>l; cpt (FV \<phi>2) env1 \<pi>l1; local.eqOn (FV \<phi>2) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>2 env \<pi>l = sem \<phi>2 env1 \<pi>l1; wff (Dis \<phi>1 \<phi>2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Dis \<phi>1 \<phi>2)) env \<pi>l; cpt (FV (Dis \<phi>1 \<phi>2)) env1 \<pi>l1; local.eqOn (FV (Dis \<phi>1 \<phi>2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Dis \<phi>1 \<phi>2) env \<pi>l = sem (Dis \<phi>1 \<phi>2) env1 \<pi>l1
 5. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Next \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Next \<phi>)) env \<pi>l; cpt (FV (Next \<phi>)) env1 \<pi>l1; local.eqOn (FV (Next \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Next \<phi>) env \<pi>l = sem (Next \<phi>) env1 \<pi>l1
 6. \<And>\<phi>1 \<phi>2 env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>1; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>1) env \<pi>l; cpt (FV \<phi>1) env1 \<pi>l1; local.eqOn (FV \<phi>1) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>1 env \<pi>l = sem \<phi>1 env1 \<pi>l1; \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>2; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>2) env \<pi>l; cpt (FV \<phi>2) env1 \<pi>l1; local.eqOn (FV \<phi>2) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>2 env \<pi>l = sem \<phi>2 env1 \<pi>l1; wff (Until \<phi>1 \<phi>2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Until \<phi>1 \<phi>2)) env \<pi>l; cpt (FV (Until \<phi>1 \<phi>2)) env1 \<pi>l1; local.eqOn (FV (Until \<phi>1 \<phi>2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Until \<phi>1 \<phi>2) env \<pi>l = sem (Until \<phi>1 \<phi>2) env1 \<pi>l1
 7. \<And>x1 \<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Exi x1 \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Exi x1 \<phi>)) env \<pi>l; cpt (FV (Exi x1 \<phi>)) env1 \<pi>l1; local.eqOn (FV (Exi x1 \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Exi x1 \<phi>) env \<pi>l = sem (Exi x1 \<phi>) env1 \<pi>l1
[PROOF STEP]
case (Until \<phi> \<psi> env \<pi>l env1 \<pi>l1)
[PROOF STATE]
proof (state)
this:
\<lbrakk>wff \<phi>; pointerOf ?\<pi>l = pointerOf ?\<pi>l1.0; cpt (FV \<phi>) ?env ?\<pi>l; cpt (FV \<phi>) ?env1.0 ?\<pi>l1.0; local.eqOn (FV \<phi>) ?env ?\<pi>l ?env1.0 ?\<pi>l1.0\<rbrakk> \<Longrightarrow> sem \<phi> ?env ?\<pi>l = sem \<phi> ?env1.0 ?\<pi>l1.0
\<lbrakk>wff \<psi>; pointerOf ?\<pi>l = pointerOf ?\<pi>l1.0; cpt (FV \<psi>) ?env ?\<pi>l; cpt (FV \<psi>) ?env1.0 ?\<pi>l1.0; local.eqOn (FV \<psi>) ?env ?\<pi>l ?env1.0 ?\<pi>l1.0\<rbrakk> \<Longrightarrow> sem \<psi> ?env ?\<pi>l = sem \<psi> ?env1.0 ?\<pi>l1.0
wff (Until \<phi> \<psi>)
pointerOf \<pi>l = pointerOf \<pi>l1
cpt (FV (Until \<phi> \<psi>)) env \<pi>l
cpt (FV (Until \<phi> \<psi>)) env1 \<pi>l1
local.eqOn (FV (Until \<phi> \<psi>)) env \<pi>l env1 \<pi>l1

goal (7 subgoals):
 1. \<And>x1 x2 env \<pi>l env1 \<pi>l1. \<lbrakk>wff (Atom x1 x2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Atom x1 x2)) env \<pi>l; cpt (FV (Atom x1 x2)) env1 \<pi>l1; local.eqOn (FV (Atom x1 x2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Atom x1 x2) env \<pi>l = sem (Atom x1 x2) env1 \<pi>l1
 2. \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff Fls; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV Fls) env \<pi>l; cpt (FV Fls) env1 \<pi>l1; local.eqOn (FV Fls) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem Fls env \<pi>l = sem Fls env1 \<pi>l1
 3. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Neg \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Neg \<phi>)) env \<pi>l; cpt (FV (Neg \<phi>)) env1 \<pi>l1; local.eqOn (FV (Neg \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Neg \<phi>) env \<pi>l = sem (Neg \<phi>) env1 \<pi>l1
 4. \<And>\<phi>1 \<phi>2 env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>1; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>1) env \<pi>l; cpt (FV \<phi>1) env1 \<pi>l1; local.eqOn (FV \<phi>1) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>1 env \<pi>l = sem \<phi>1 env1 \<pi>l1; \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>2; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>2) env \<pi>l; cpt (FV \<phi>2) env1 \<pi>l1; local.eqOn (FV \<phi>2) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>2 env \<pi>l = sem \<phi>2 env1 \<pi>l1; wff (Dis \<phi>1 \<phi>2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Dis \<phi>1 \<phi>2)) env \<pi>l; cpt (FV (Dis \<phi>1 \<phi>2)) env1 \<pi>l1; local.eqOn (FV (Dis \<phi>1 \<phi>2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Dis \<phi>1 \<phi>2) env \<pi>l = sem (Dis \<phi>1 \<phi>2) env1 \<pi>l1
 5. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Next \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Next \<phi>)) env \<pi>l; cpt (FV (Next \<phi>)) env1 \<pi>l1; local.eqOn (FV (Next \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Next \<phi>) env \<pi>l = sem (Next \<phi>) env1 \<pi>l1
 6. \<And>\<phi>1 \<phi>2 env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>1; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>1) env \<pi>l; cpt (FV \<phi>1) env1 \<pi>l1; local.eqOn (FV \<phi>1) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>1 env \<pi>l = sem \<phi>1 env1 \<pi>l1; \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>2; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>2) env \<pi>l; cpt (FV \<phi>2) env1 \<pi>l1; local.eqOn (FV \<phi>2) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>2 env \<pi>l = sem \<phi>2 env1 \<pi>l1; wff (Until \<phi>1 \<phi>2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Until \<phi>1 \<phi>2)) env \<pi>l; cpt (FV (Until \<phi>1 \<phi>2)) env1 \<pi>l1; local.eqOn (FV (Until \<phi>1 \<phi>2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Until \<phi>1 \<phi>2) env \<pi>l = sem (Until \<phi>1 \<phi>2) env1 \<pi>l1
 7. \<And>x1 \<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Exi x1 \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Exi x1 \<phi>)) env \<pi>l; cpt (FV (Exi x1 \<phi>)) env1 \<pi>l1; local.eqOn (FV (Exi x1 \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Exi x1 \<phi>) env \<pi>l = sem (Exi x1 \<phi>) env1 \<pi>l1
[PROOF STEP]
hence "\<And> i. sem \<phi> env (map (sdrop i) \<pi>l) = sem \<phi> env1 (map (sdrop i) \<pi>l1) \<and>
              sem \<psi> env (map (sdrop i) \<pi>l) = sem \<psi> env1 (map (sdrop i) \<pi>l1)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>wff \<phi>; pointerOf ?\<pi>l = pointerOf ?\<pi>l1.0; cpt (FV \<phi>) ?env ?\<pi>l; cpt (FV \<phi>) ?env1.0 ?\<pi>l1.0; local.eqOn (FV \<phi>) ?env ?\<pi>l ?env1.0 ?\<pi>l1.0\<rbrakk> \<Longrightarrow> sem \<phi> ?env ?\<pi>l = sem \<phi> ?env1.0 ?\<pi>l1.0
\<lbrakk>wff \<psi>; pointerOf ?\<pi>l = pointerOf ?\<pi>l1.0; cpt (FV \<psi>) ?env ?\<pi>l; cpt (FV \<psi>) ?env1.0 ?\<pi>l1.0; local.eqOn (FV \<psi>) ?env ?\<pi>l ?env1.0 ?\<pi>l1.0\<rbrakk> \<Longrightarrow> sem \<psi> ?env ?\<pi>l = sem \<psi> ?env1.0 ?\<pi>l1.0
wff (Until \<phi> \<psi>)
pointerOf \<pi>l = pointerOf \<pi>l1
cpt (FV (Until \<phi> \<psi>)) env \<pi>l
cpt (FV (Until \<phi> \<psi>)) env1 \<pi>l1
local.eqOn (FV (Until \<phi> \<psi>)) env \<pi>l env1 \<pi>l1

goal (1 subgoal):
 1. \<And>i. sem \<phi> env (map (sdrop i) \<pi>l) = sem \<phi> env1 (map (sdrop i) \<pi>l1) \<and> sem \<psi> env (map (sdrop i) \<pi>l) = sem \<psi> env1 (map (sdrop i) \<pi>l1)
[PROOF STEP]
using Until
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>wff \<phi>; pointerOf ?\<pi>l = pointerOf ?\<pi>l1.0; cpt (FV \<phi>) ?env ?\<pi>l; cpt (FV \<phi>) ?env1.0 ?\<pi>l1.0; local.eqOn (FV \<phi>) ?env ?\<pi>l ?env1.0 ?\<pi>l1.0\<rbrakk> \<Longrightarrow> sem \<phi> ?env ?\<pi>l = sem \<phi> ?env1.0 ?\<pi>l1.0
\<lbrakk>wff \<psi>; pointerOf ?\<pi>l = pointerOf ?\<pi>l1.0; cpt (FV \<psi>) ?env ?\<pi>l; cpt (FV \<psi>) ?env1.0 ?\<pi>l1.0; local.eqOn (FV \<psi>) ?env ?\<pi>l ?env1.0 ?\<pi>l1.0\<rbrakk> \<Longrightarrow> sem \<psi> ?env ?\<pi>l = sem \<psi> ?env1.0 ?\<pi>l1.0
wff (Until \<phi> \<psi>)
pointerOf \<pi>l = pointerOf \<pi>l1
cpt (FV (Until \<phi> \<psi>)) env \<pi>l
cpt (FV (Until \<phi> \<psi>)) env1 \<pi>l1
local.eqOn (FV (Until \<phi> \<psi>)) env \<pi>l env1 \<pi>l1
\<lbrakk>wff \<phi>; pointerOf ?\<pi>l = pointerOf ?\<pi>l1.0; cpt (FV \<phi>) ?env ?\<pi>l; cpt (FV \<phi>) ?env1.0 ?\<pi>l1.0; local.eqOn (FV \<phi>) ?env ?\<pi>l ?env1.0 ?\<pi>l1.0\<rbrakk> \<Longrightarrow> sem \<phi> ?env ?\<pi>l = sem \<phi> ?env1.0 ?\<pi>l1.0
\<lbrakk>wff \<psi>; pointerOf ?\<pi>l = pointerOf ?\<pi>l1.0; cpt (FV \<psi>) ?env ?\<pi>l; cpt (FV \<psi>) ?env1.0 ?\<pi>l1.0; local.eqOn (FV \<psi>) ?env ?\<pi>l ?env1.0 ?\<pi>l1.0\<rbrakk> \<Longrightarrow> sem \<psi> ?env ?\<pi>l = sem \<psi> ?env1.0 ?\<pi>l1.0
wff (Until \<phi> \<psi>)
pointerOf \<pi>l = pointerOf \<pi>l1
cpt (FV (Until \<phi> \<psi>)) env \<pi>l
cpt (FV (Until \<phi> \<psi>)) env1 \<pi>l1
local.eqOn (FV (Until \<phi> \<psi>)) env \<pi>l env1 \<pi>l1

goal (1 subgoal):
 1. \<And>i. sem \<phi> env (map (sdrop i) \<pi>l) = sem \<phi> env1 (map (sdrop i) \<pi>l1) \<and> sem \<psi> env (map (sdrop i) \<pi>l) = sem \<psi> env1 (map (sdrop i) \<pi>l1)
[PROOF STEP]
by (auto simp: last_map)
[PROOF STATE]
proof (state)
this:
sem \<phi> env (map (sdrop ?i) \<pi>l) = sem \<phi> env1 (map (sdrop ?i) \<pi>l1) \<and> sem \<psi> env (map (sdrop ?i) \<pi>l) = sem \<psi> env1 (map (sdrop ?i) \<pi>l1)

goal (7 subgoals):
 1. \<And>x1 x2 env \<pi>l env1 \<pi>l1. \<lbrakk>wff (Atom x1 x2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Atom x1 x2)) env \<pi>l; cpt (FV (Atom x1 x2)) env1 \<pi>l1; local.eqOn (FV (Atom x1 x2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Atom x1 x2) env \<pi>l = sem (Atom x1 x2) env1 \<pi>l1
 2. \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff Fls; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV Fls) env \<pi>l; cpt (FV Fls) env1 \<pi>l1; local.eqOn (FV Fls) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem Fls env \<pi>l = sem Fls env1 \<pi>l1
 3. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Neg \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Neg \<phi>)) env \<pi>l; cpt (FV (Neg \<phi>)) env1 \<pi>l1; local.eqOn (FV (Neg \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Neg \<phi>) env \<pi>l = sem (Neg \<phi>) env1 \<pi>l1
 4. \<And>\<phi>1 \<phi>2 env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>1; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>1) env \<pi>l; cpt (FV \<phi>1) env1 \<pi>l1; local.eqOn (FV \<phi>1) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>1 env \<pi>l = sem \<phi>1 env1 \<pi>l1; \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>2; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>2) env \<pi>l; cpt (FV \<phi>2) env1 \<pi>l1; local.eqOn (FV \<phi>2) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>2 env \<pi>l = sem \<phi>2 env1 \<pi>l1; wff (Dis \<phi>1 \<phi>2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Dis \<phi>1 \<phi>2)) env \<pi>l; cpt (FV (Dis \<phi>1 \<phi>2)) env1 \<pi>l1; local.eqOn (FV (Dis \<phi>1 \<phi>2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Dis \<phi>1 \<phi>2) env \<pi>l = sem (Dis \<phi>1 \<phi>2) env1 \<pi>l1
 5. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Next \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Next \<phi>)) env \<pi>l; cpt (FV (Next \<phi>)) env1 \<pi>l1; local.eqOn (FV (Next \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Next \<phi>) env \<pi>l = sem (Next \<phi>) env1 \<pi>l1
 6. \<And>\<phi>1 \<phi>2 env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>1; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>1) env \<pi>l; cpt (FV \<phi>1) env1 \<pi>l1; local.eqOn (FV \<phi>1) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>1 env \<pi>l = sem \<phi>1 env1 \<pi>l1; \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>2; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>2) env \<pi>l; cpt (FV \<phi>2) env1 \<pi>l1; local.eqOn (FV \<phi>2) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>2 env \<pi>l = sem \<phi>2 env1 \<pi>l1; wff (Until \<phi>1 \<phi>2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Until \<phi>1 \<phi>2)) env \<pi>l; cpt (FV (Until \<phi>1 \<phi>2)) env1 \<pi>l1; local.eqOn (FV (Until \<phi>1 \<phi>2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Until \<phi>1 \<phi>2) env \<pi>l = sem (Until \<phi>1 \<phi>2) env1 \<pi>l1
 7. \<And>x1 \<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Exi x1 \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Exi x1 \<phi>)) env \<pi>l; cpt (FV (Exi x1 \<phi>)) env1 \<pi>l1; local.eqOn (FV (Exi x1 \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Exi x1 \<phi>) env \<pi>l = sem (Exi x1 \<phi>) env1 \<pi>l1
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
sem \<phi> env (map (sdrop ?i) \<pi>l) = sem \<phi> env1 (map (sdrop ?i) \<pi>l1) \<and> sem \<psi> env (map (sdrop ?i) \<pi>l) = sem \<psi> env1 (map (sdrop ?i) \<pi>l1)

goal (1 subgoal):
 1. sem (Until \<phi> \<psi>) env \<pi>l = sem (Until \<phi> \<psi>) env1 \<pi>l1
[PROOF STEP]
by (auto simp: op_defs)
[PROOF STATE]
proof (state)
this:
sem (Until \<phi> \<psi>) env \<pi>l = sem (Until \<phi> \<psi>) env1 \<pi>l1

goal (6 subgoals):
 1. \<And>x1 x2 env \<pi>l env1 \<pi>l1. \<lbrakk>wff (Atom x1 x2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Atom x1 x2)) env \<pi>l; cpt (FV (Atom x1 x2)) env1 \<pi>l1; local.eqOn (FV (Atom x1 x2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Atom x1 x2) env \<pi>l = sem (Atom x1 x2) env1 \<pi>l1
 2. \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff Fls; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV Fls) env \<pi>l; cpt (FV Fls) env1 \<pi>l1; local.eqOn (FV Fls) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem Fls env \<pi>l = sem Fls env1 \<pi>l1
 3. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Neg \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Neg \<phi>)) env \<pi>l; cpt (FV (Neg \<phi>)) env1 \<pi>l1; local.eqOn (FV (Neg \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Neg \<phi>) env \<pi>l = sem (Neg \<phi>) env1 \<pi>l1
 4. \<And>\<phi>1 \<phi>2 env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>1; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>1) env \<pi>l; cpt (FV \<phi>1) env1 \<pi>l1; local.eqOn (FV \<phi>1) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>1 env \<pi>l = sem \<phi>1 env1 \<pi>l1; \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>2; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>2) env \<pi>l; cpt (FV \<phi>2) env1 \<pi>l1; local.eqOn (FV \<phi>2) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>2 env \<pi>l = sem \<phi>2 env1 \<pi>l1; wff (Dis \<phi>1 \<phi>2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Dis \<phi>1 \<phi>2)) env \<pi>l; cpt (FV (Dis \<phi>1 \<phi>2)) env1 \<pi>l1; local.eqOn (FV (Dis \<phi>1 \<phi>2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Dis \<phi>1 \<phi>2) env \<pi>l = sem (Dis \<phi>1 \<phi>2) env1 \<pi>l1
 5. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Next \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Next \<phi>)) env \<pi>l; cpt (FV (Next \<phi>)) env1 \<pi>l1; local.eqOn (FV (Next \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Next \<phi>) env \<pi>l = sem (Next \<phi>) env1 \<pi>l1
 6. \<And>x1 \<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Exi x1 \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Exi x1 \<phi>)) env \<pi>l; cpt (FV (Exi x1 \<phi>)) env1 \<pi>l1; local.eqOn (FV (Exi x1 \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Exi x1 \<phi>) env \<pi>l = sem (Exi x1 \<phi>) env1 \<pi>l1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>x1 x2 env \<pi>l env1 \<pi>l1. \<lbrakk>wff (Atom x1 x2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Atom x1 x2)) env \<pi>l; cpt (FV (Atom x1 x2)) env1 \<pi>l1; local.eqOn (FV (Atom x1 x2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Atom x1 x2) env \<pi>l = sem (Atom x1 x2) env1 \<pi>l1
 2. \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff Fls; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV Fls) env \<pi>l; cpt (FV Fls) env1 \<pi>l1; local.eqOn (FV Fls) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem Fls env \<pi>l = sem Fls env1 \<pi>l1
 3. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Neg \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Neg \<phi>)) env \<pi>l; cpt (FV (Neg \<phi>)) env1 \<pi>l1; local.eqOn (FV (Neg \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Neg \<phi>) env \<pi>l = sem (Neg \<phi>) env1 \<pi>l1
 4. \<And>\<phi>1 \<phi>2 env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>1; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>1) env \<pi>l; cpt (FV \<phi>1) env1 \<pi>l1; local.eqOn (FV \<phi>1) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>1 env \<pi>l = sem \<phi>1 env1 \<pi>l1; \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>2; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>2) env \<pi>l; cpt (FV \<phi>2) env1 \<pi>l1; local.eqOn (FV \<phi>2) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>2 env \<pi>l = sem \<phi>2 env1 \<pi>l1; wff (Dis \<phi>1 \<phi>2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Dis \<phi>1 \<phi>2)) env \<pi>l; cpt (FV (Dis \<phi>1 \<phi>2)) env1 \<pi>l1; local.eqOn (FV (Dis \<phi>1 \<phi>2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Dis \<phi>1 \<phi>2) env \<pi>l = sem (Dis \<phi>1 \<phi>2) env1 \<pi>l1
 5. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Next \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Next \<phi>)) env \<pi>l; cpt (FV (Next \<phi>)) env1 \<pi>l1; local.eqOn (FV (Next \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Next \<phi>) env \<pi>l = sem (Next \<phi>) env1 \<pi>l1
 6. \<And>x1 \<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Exi x1 \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Exi x1 \<phi>)) env \<pi>l; cpt (FV (Exi x1 \<phi>)) env1 \<pi>l1; local.eqOn (FV (Exi x1 \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Exi x1 \<phi>) env \<pi>l = sem (Exi x1 \<phi>) env1 \<pi>l1
[PROOF STEP]
case (Exi p \<phi> env \<pi>l env1 \<pi>l1)
[PROOF STATE]
proof (state)
this:
\<lbrakk>wff \<phi>; pointerOf ?\<pi>l = pointerOf ?\<pi>l1.0; cpt (FV \<phi>) ?env ?\<pi>l; cpt (FV \<phi>) ?env1.0 ?\<pi>l1.0; local.eqOn (FV \<phi>) ?env ?\<pi>l ?env1.0 ?\<pi>l1.0\<rbrakk> \<Longrightarrow> sem \<phi> ?env ?\<pi>l = sem \<phi> ?env1.0 ?\<pi>l1.0
wff (Exi p \<phi>)
pointerOf \<pi>l = pointerOf \<pi>l1
cpt (FV (Exi p \<phi>)) env \<pi>l
cpt (FV (Exi p \<phi>)) env1 \<pi>l1
local.eqOn (FV (Exi p \<phi>)) env \<pi>l env1 \<pi>l1

goal (6 subgoals):
 1. \<And>x1 x2 env \<pi>l env1 \<pi>l1. \<lbrakk>wff (Atom x1 x2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Atom x1 x2)) env \<pi>l; cpt (FV (Atom x1 x2)) env1 \<pi>l1; local.eqOn (FV (Atom x1 x2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Atom x1 x2) env \<pi>l = sem (Atom x1 x2) env1 \<pi>l1
 2. \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff Fls; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV Fls) env \<pi>l; cpt (FV Fls) env1 \<pi>l1; local.eqOn (FV Fls) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem Fls env \<pi>l = sem Fls env1 \<pi>l1
 3. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Neg \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Neg \<phi>)) env \<pi>l; cpt (FV (Neg \<phi>)) env1 \<pi>l1; local.eqOn (FV (Neg \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Neg \<phi>) env \<pi>l = sem (Neg \<phi>) env1 \<pi>l1
 4. \<And>\<phi>1 \<phi>2 env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>1; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>1) env \<pi>l; cpt (FV \<phi>1) env1 \<pi>l1; local.eqOn (FV \<phi>1) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>1 env \<pi>l = sem \<phi>1 env1 \<pi>l1; \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>2; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>2) env \<pi>l; cpt (FV \<phi>2) env1 \<pi>l1; local.eqOn (FV \<phi>2) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>2 env \<pi>l = sem \<phi>2 env1 \<pi>l1; wff (Dis \<phi>1 \<phi>2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Dis \<phi>1 \<phi>2)) env \<pi>l; cpt (FV (Dis \<phi>1 \<phi>2)) env1 \<pi>l1; local.eqOn (FV (Dis \<phi>1 \<phi>2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Dis \<phi>1 \<phi>2) env \<pi>l = sem (Dis \<phi>1 \<phi>2) env1 \<pi>l1
 5. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Next \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Next \<phi>)) env \<pi>l; cpt (FV (Next \<phi>)) env1 \<pi>l1; local.eqOn (FV (Next \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Next \<phi>) env \<pi>l = sem (Next \<phi>) env1 \<pi>l1
 6. \<And>x1 \<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Exi x1 \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Exi x1 \<phi>)) env \<pi>l; cpt (FV (Exi x1 \<phi>)) env1 \<pi>l1; local.eqOn (FV (Exi x1 \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Exi x1 \<phi>) env \<pi>l = sem (Exi x1 \<phi>) env1 \<pi>l1
[PROOF STEP]
have "\<And> \<pi>. sem \<phi> (env(p := length \<pi>l)) (\<pi>l @ [\<pi>]) =
             sem \<phi> (env1(p := length \<pi>l1)) (\<pi>l1 @ [\<pi>])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<pi>. sem \<phi> (env(p := length \<pi>l)) (\<pi>l @ [\<pi>]) = sem \<phi> (env1(p := length \<pi>l1)) (\<pi>l1 @ [\<pi>])
[PROOF STEP]
apply(rule eqOn_FV_sem_NE)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>\<pi>. cpt (FV \<phi>) (env(p := length \<pi>l)) (\<pi>l @ [\<pi>])
 2. \<And>\<pi>. cpt (FV \<phi>) (env1(p := length \<pi>l1)) (\<pi>l1 @ [\<pi>])
 3. \<And>\<pi>. local.eqOn (FV \<phi>) (env(p := length \<pi>l)) (\<pi>l @ [\<pi>]) (env1(p := length \<pi>l1)) (\<pi>l1 @ [\<pi>])
 4. \<And>\<pi>. \<pi>l @ [\<pi>] \<noteq> []
 5. \<And>\<pi>. \<pi>l1 @ [\<pi>] \<noteq> []
 6. \<And>\<pi>. last (\<pi>l @ [\<pi>]) = last (\<pi>l1 @ [\<pi>])
[PROOF STEP]
using Exi
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>wff \<phi>; pointerOf ?\<pi>l = pointerOf ?\<pi>l1.0; cpt (FV \<phi>) ?env ?\<pi>l; cpt (FV \<phi>) ?env1.0 ?\<pi>l1.0; local.eqOn (FV \<phi>) ?env ?\<pi>l ?env1.0 ?\<pi>l1.0\<rbrakk> \<Longrightarrow> sem \<phi> ?env ?\<pi>l = sem \<phi> ?env1.0 ?\<pi>l1.0
wff (Exi p \<phi>)
pointerOf \<pi>l = pointerOf \<pi>l1
cpt (FV (Exi p \<phi>)) env \<pi>l
cpt (FV (Exi p \<phi>)) env1 \<pi>l1
local.eqOn (FV (Exi p \<phi>)) env \<pi>l env1 \<pi>l1

goal (6 subgoals):
 1. \<And>\<pi>. cpt (FV \<phi>) (env(p := length \<pi>l)) (\<pi>l @ [\<pi>])
 2. \<And>\<pi>. cpt (FV \<phi>) (env1(p := length \<pi>l1)) (\<pi>l1 @ [\<pi>])
 3. \<And>\<pi>. local.eqOn (FV \<phi>) (env(p := length \<pi>l)) (\<pi>l @ [\<pi>]) (env1(p := length \<pi>l1)) (\<pi>l1 @ [\<pi>])
 4. \<And>\<pi>. \<pi>l @ [\<pi>] \<noteq> []
 5. \<And>\<pi>. \<pi>l1 @ [\<pi>] \<noteq> []
 6. \<And>\<pi>. last (\<pi>l @ [\<pi>]) = last (\<pi>l1 @ [\<pi>])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
sem \<phi> (env(p := length \<pi>l)) (\<pi>l @ [?\<pi>]) = sem \<phi> (env1(p := length \<pi>l1)) (\<pi>l1 @ [?\<pi>])

goal (6 subgoals):
 1. \<And>x1 x2 env \<pi>l env1 \<pi>l1. \<lbrakk>wff (Atom x1 x2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Atom x1 x2)) env \<pi>l; cpt (FV (Atom x1 x2)) env1 \<pi>l1; local.eqOn (FV (Atom x1 x2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Atom x1 x2) env \<pi>l = sem (Atom x1 x2) env1 \<pi>l1
 2. \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff Fls; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV Fls) env \<pi>l; cpt (FV Fls) env1 \<pi>l1; local.eqOn (FV Fls) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem Fls env \<pi>l = sem Fls env1 \<pi>l1
 3. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Neg \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Neg \<phi>)) env \<pi>l; cpt (FV (Neg \<phi>)) env1 \<pi>l1; local.eqOn (FV (Neg \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Neg \<phi>) env \<pi>l = sem (Neg \<phi>) env1 \<pi>l1
 4. \<And>\<phi>1 \<phi>2 env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>1; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>1) env \<pi>l; cpt (FV \<phi>1) env1 \<pi>l1; local.eqOn (FV \<phi>1) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>1 env \<pi>l = sem \<phi>1 env1 \<pi>l1; \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>2; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>2) env \<pi>l; cpt (FV \<phi>2) env1 \<pi>l1; local.eqOn (FV \<phi>2) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>2 env \<pi>l = sem \<phi>2 env1 \<pi>l1; wff (Dis \<phi>1 \<phi>2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Dis \<phi>1 \<phi>2)) env \<pi>l; cpt (FV (Dis \<phi>1 \<phi>2)) env1 \<pi>l1; local.eqOn (FV (Dis \<phi>1 \<phi>2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Dis \<phi>1 \<phi>2) env \<pi>l = sem (Dis \<phi>1 \<phi>2) env1 \<pi>l1
 5. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Next \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Next \<phi>)) env \<pi>l; cpt (FV (Next \<phi>)) env1 \<pi>l1; local.eqOn (FV (Next \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Next \<phi>) env \<pi>l = sem (Next \<phi>) env1 \<pi>l1
 6. \<And>x1 \<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Exi x1 \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Exi x1 \<phi>)) env \<pi>l; cpt (FV (Exi x1 \<phi>)) env1 \<pi>l1; local.eqOn (FV (Exi x1 \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Exi x1 \<phi>) env \<pi>l = sem (Exi x1 \<phi>) env1 \<pi>l1
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
sem \<phi> (env(p := length \<pi>l)) (\<pi>l @ [?\<pi>]) = sem \<phi> (env1(p := length \<pi>l1)) (\<pi>l1 @ [?\<pi>])

goal (1 subgoal):
 1. sem (Exi p \<phi>) env \<pi>l = sem (Exi p \<phi>) env1 \<pi>l1
[PROOF STEP]
unfolding sem.simps exi_def
[PROOF STATE]
proof (prove)
using this:
sem \<phi> (env(p := length \<pi>l)) (\<pi>l @ [?\<pi>]) = sem \<phi> (env1(p := length \<pi>l1)) (\<pi>l1 @ [?\<pi>])

goal (1 subgoal):
 1. (\<exists>\<pi>. wfp AP' \<pi> \<and> stateOf \<pi> = (if \<pi>l \<noteq> [] then stateOf (last \<pi>l) else s0) \<and> sem \<phi> (env(p := length \<pi>l)) (\<pi>l @ [\<pi>])) = (\<exists>\<pi>. wfp AP' \<pi> \<and> stateOf \<pi> = (if \<pi>l1 \<noteq> [] then stateOf (last \<pi>l1) else s0) \<and> sem \<phi> (env1(p := length \<pi>l1)) (\<pi>l1 @ [\<pi>]))
[PROOF STEP]
using Exi
[PROOF STATE]
proof (prove)
using this:
sem \<phi> (env(p := length \<pi>l)) (\<pi>l @ [?\<pi>]) = sem \<phi> (env1(p := length \<pi>l1)) (\<pi>l1 @ [?\<pi>])
\<lbrakk>wff \<phi>; pointerOf ?\<pi>l = pointerOf ?\<pi>l1.0; cpt (FV \<phi>) ?env ?\<pi>l; cpt (FV \<phi>) ?env1.0 ?\<pi>l1.0; local.eqOn (FV \<phi>) ?env ?\<pi>l ?env1.0 ?\<pi>l1.0\<rbrakk> \<Longrightarrow> sem \<phi> ?env ?\<pi>l = sem \<phi> ?env1.0 ?\<pi>l1.0
wff (Exi p \<phi>)
pointerOf \<pi>l = pointerOf \<pi>l1
cpt (FV (Exi p \<phi>)) env \<pi>l
cpt (FV (Exi p \<phi>)) env1 \<pi>l1
local.eqOn (FV (Exi p \<phi>)) env \<pi>l env1 \<pi>l1

goal (1 subgoal):
 1. (\<exists>\<pi>. wfp AP' \<pi> \<and> stateOf \<pi> = (if \<pi>l \<noteq> [] then stateOf (last \<pi>l) else s0) \<and> sem \<phi> (env(p := length \<pi>l)) (\<pi>l @ [\<pi>])) = (\<exists>\<pi>. wfp AP' \<pi> \<and> stateOf \<pi> = (if \<pi>l1 \<noteq> [] then stateOf (last \<pi>l1) else s0) \<and> sem \<phi> (env1(p := length \<pi>l1)) (\<pi>l1 @ [\<pi>]))
[PROOF STEP]
by (intro iff_exI conj_cong) simp_all
[PROOF STATE]
proof (state)
this:
sem (Exi p \<phi>) env \<pi>l = sem (Exi p \<phi>) env1 \<pi>l1

goal (5 subgoals):
 1. \<And>x1 x2 env \<pi>l env1 \<pi>l1. \<lbrakk>wff (Atom x1 x2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Atom x1 x2)) env \<pi>l; cpt (FV (Atom x1 x2)) env1 \<pi>l1; local.eqOn (FV (Atom x1 x2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Atom x1 x2) env \<pi>l = sem (Atom x1 x2) env1 \<pi>l1
 2. \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff Fls; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV Fls) env \<pi>l; cpt (FV Fls) env1 \<pi>l1; local.eqOn (FV Fls) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem Fls env \<pi>l = sem Fls env1 \<pi>l1
 3. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Neg \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Neg \<phi>)) env \<pi>l; cpt (FV (Neg \<phi>)) env1 \<pi>l1; local.eqOn (FV (Neg \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Neg \<phi>) env \<pi>l = sem (Neg \<phi>) env1 \<pi>l1
 4. \<And>\<phi>1 \<phi>2 env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>1; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>1) env \<pi>l; cpt (FV \<phi>1) env1 \<pi>l1; local.eqOn (FV \<phi>1) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>1 env \<pi>l = sem \<phi>1 env1 \<pi>l1; \<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>2; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>2) env \<pi>l; cpt (FV \<phi>2) env1 \<pi>l1; local.eqOn (FV \<phi>2) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi>2 env \<pi>l = sem \<phi>2 env1 \<pi>l1; wff (Dis \<phi>1 \<phi>2); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Dis \<phi>1 \<phi>2)) env \<pi>l; cpt (FV (Dis \<phi>1 \<phi>2)) env1 \<pi>l1; local.eqOn (FV (Dis \<phi>1 \<phi>2)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Dis \<phi>1 \<phi>2) env \<pi>l = sem (Dis \<phi>1 \<phi>2) env1 \<pi>l1
 5. \<And>\<phi> env \<pi>l env1 \<pi>l1. \<lbrakk>\<And>env \<pi>l env1 \<pi>l1. \<lbrakk>wff \<phi>; pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV \<phi>) env \<pi>l; cpt (FV \<phi>) env1 \<pi>l1; local.eqOn (FV \<phi>) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem \<phi> env \<pi>l = sem \<phi> env1 \<pi>l1; wff (Next \<phi>); pointerOf \<pi>l = pointerOf \<pi>l1; cpt (FV (Next \<phi>)) env \<pi>l; cpt (FV (Next \<phi>)) env1 \<pi>l1; local.eqOn (FV (Next \<phi>)) env \<pi>l env1 \<pi>l1\<rbrakk> \<Longrightarrow> sem (Next \<phi>) env \<pi>l = sem (Next \<phi>) env1 \<pi>l1
[PROOF STEP]
qed(auto simp: last_map op_defs)