[STATEMENT]
lemma compatible_modes_new_vars:
  "length mdss = length cms \<Longrightarrow> modes_respect_priv mdss \<Longrightarrow> conc.compatible_modes (conc.restrict_modes mdss (- range var\<^sub>C_of))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>length mdss = length cms; modes_respect_priv mdss\<rbrakk> \<Longrightarrow> conc.compatible_modes (conc.restrict_modes mdss (- range var\<^sub>C_of))
[PROOF STEP]
unfolding conc.compatible_modes_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>length mdss = length cms; modes_respect_priv mdss\<rbrakk> \<Longrightarrow> \<forall>i x. i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)) \<longrightarrow> (x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite \<longrightarrow> (\<forall>j<length (conc.restrict_modes mdss (- range var\<^sub>C_of)). j \<noteq> i \<longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite)) \<and> (x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite \<longrightarrow> (\<forall>j<length (conc.restrict_modes mdss (- range var\<^sub>C_of)). j \<noteq> i \<longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite))
[PROOF STEP]
proof(safe)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
let ?X = "- range var\<^sub>C_of"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
let ?mdss\<^sub>X = "conc.restrict_modes mdss ?X"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
assume respect: "modes_respect_priv mdss"
[PROOF STATE]
proof (state)
this:
modes_respect_priv mdss

goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
assume len_eq: "length mdss = length cms"
[PROOF STATE]
proof (state)
this:
length mdss = length cms

goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
fix i x\<^sub>C j
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
assume ilen: "i < length ?mdss\<^sub>X"
[PROOF STATE]
proof (state)
this:
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))

goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
assume jlen: "j < length ?mdss\<^sub>X"
[PROOF STATE]
proof (state)
this:
j < length (conc.restrict_modes mdss (- range var\<^sub>C_of))

goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
assume neq: "j \<noteq> i"
[PROOF STATE]
proof (state)
this:
j \<noteq> i

goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
assume asm\<^sub>X: "x\<^sub>C \<in> (?mdss\<^sub>X ! i) AsmNoWrite"
[PROOF STATE]
proof (state)
this:
x\<^sub>C \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite

goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
from conc.in_restrict_modesD ilen asm\<^sub>X conc.restrict_modes_length
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?i < length ?mdss; ?x \<in> (conc.restrict_modes ?mdss ?X ! ?i) ?m\<rbrakk> \<Longrightarrow> ?x \<in> ?X \<and> ?x \<in> (?mdss ! ?i) ?m
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
x\<^sub>C \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite
length (conc.restrict_modes ?mdss ?X) = length ?mdss
[PROOF STEP]
have
    xin: "x\<^sub>C \<in> ?X" and
    asm: "x\<^sub>C \<in> (mdss ! i) AsmNoWrite"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?i < length ?mdss; ?x \<in> (conc.restrict_modes ?mdss ?X ! ?i) ?m\<rbrakk> \<Longrightarrow> ?x \<in> ?X \<and> ?x \<in> (?mdss ! ?i) ?m
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
x\<^sub>C \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite
length (conc.restrict_modes ?mdss ?X) = length ?mdss

goal (1 subgoal):
 1. x\<^sub>C \<in> - range var\<^sub>C_of &&& x\<^sub>C \<in> (mdss ! i) AsmNoWrite
[PROOF STEP]
by metis+
[PROOF STATE]
proof (state)
this:
x\<^sub>C \<in> - range var\<^sub>C_of
x\<^sub>C \<in> (mdss ! i) AsmNoWrite

goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
from asm
[PROOF STATE]
proof (chain)
picking this:
x\<^sub>C \<in> (mdss ! i) AsmNoWrite
[PROOF STEP]
have "False"
[PROOF STATE]
proof (prove)
using this:
x\<^sub>C \<in> (mdss ! i) AsmNoWrite

goal (1 subgoal):
 1. False
[PROOF STEP]
using respect xin ilen conc.restrict_modes_length len_eq
[PROOF STATE]
proof (prove)
using this:
x\<^sub>C \<in> (mdss ! i) AsmNoWrite
modes_respect_priv mdss
x\<^sub>C \<in> - range var\<^sub>C_of
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
length (conc.restrict_modes ?mdss ?X) = length ?mdss
length mdss = length cms

goal (1 subgoal):
 1. False
[PROOF STEP]
unfolding modes_respect_priv_def new_asms_NoReadOrWrite_only_def
[PROOF STATE]
proof (prove)
using this:
x\<^sub>C \<in> (mdss ! i) AsmNoWrite
priv_is_asm_priv mdss \<and> priv_is_guar_priv mdss \<and> new_asms_only_for_priv mdss \<and> (\<forall>i<length cms. (mdss ! i) AsmNoWrite \<inter> - range var\<^sub>C_of = {})
x\<^sub>C \<in> - range var\<^sub>C_of
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
length (conc.restrict_modes ?mdss ?X) = length ?mdss
length mdss = length cms

goal (1 subgoal):
 1. False
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
False

goal (2 subgoals):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
 2. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
thus "x\<^sub>C \<in> (?mdss\<^sub>X ! j) GuarNoWrite"
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. x\<^sub>C \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
x\<^sub>C \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoWrite

goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
let ?X = "- range var\<^sub>C_of"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
let ?mdss\<^sub>X = "conc.restrict_modes mdss ?X"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
assume respect: "modes_respect_priv mdss"
[PROOF STATE]
proof (state)
this:
modes_respect_priv mdss

goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
assume len_eq: "length mdss = length cms"
[PROOF STATE]
proof (state)
this:
length mdss = length cms

goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
fix i x\<^sub>C j
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
assume ilen: "i < length ?mdss\<^sub>X"
[PROOF STATE]
proof (state)
this:
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))

goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
assume jlen: "j < length ?mdss\<^sub>X"
[PROOF STATE]
proof (state)
this:
j < length (conc.restrict_modes mdss (- range var\<^sub>C_of))

goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
assume neq: "j \<noteq> i"
[PROOF STATE]
proof (state)
this:
j \<noteq> i

goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
assume asm\<^sub>X: "x\<^sub>C \<in> (?mdss\<^sub>X ! i) AsmNoReadOrWrite"
[PROOF STATE]
proof (state)
this:
x\<^sub>C \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite

goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
from conc.in_restrict_modesD ilen asm\<^sub>X conc.restrict_modes_length
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?i < length ?mdss; ?x \<in> (conc.restrict_modes ?mdss ?X ! ?i) ?m\<rbrakk> \<Longrightarrow> ?x \<in> ?X \<and> ?x \<in> (?mdss ! ?i) ?m
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
x\<^sub>C \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite
length (conc.restrict_modes ?mdss ?X) = length ?mdss
[PROOF STEP]
have
    xin: "x\<^sub>C \<in> ?X" and
    asm: "x\<^sub>C \<in> (mdss ! i) AsmNoReadOrWrite"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?i < length ?mdss; ?x \<in> (conc.restrict_modes ?mdss ?X ! ?i) ?m\<rbrakk> \<Longrightarrow> ?x \<in> ?X \<and> ?x \<in> (?mdss ! ?i) ?m
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
x\<^sub>C \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite
length (conc.restrict_modes ?mdss ?X) = length ?mdss

goal (1 subgoal):
 1. x\<^sub>C \<in> - range var\<^sub>C_of &&& x\<^sub>C \<in> (mdss ! i) AsmNoReadOrWrite
[PROOF STEP]
by metis+
[PROOF STATE]
proof (state)
this:
x\<^sub>C \<in> - range var\<^sub>C_of
x\<^sub>C \<in> (mdss ! i) AsmNoReadOrWrite

goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
from respect asm xin ilen conc.restrict_modes_length len_eq
[PROOF STATE]
proof (chain)
picking this:
modes_respect_priv mdss
x\<^sub>C \<in> (mdss ! i) AsmNoReadOrWrite
x\<^sub>C \<in> - range var\<^sub>C_of
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
length (conc.restrict_modes ?mdss ?X) = length ?mdss
length mdss = length cms
[PROOF STEP]
have
    "x\<^sub>C \<in> priv_mem\<^sub>C ! i"
[PROOF STATE]
proof (prove)
using this:
modes_respect_priv mdss
x\<^sub>C \<in> (mdss ! i) AsmNoReadOrWrite
x\<^sub>C \<in> - range var\<^sub>C_of
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
length (conc.restrict_modes ?mdss ?X) = length ?mdss
length mdss = length cms

goal (1 subgoal):
 1. x\<^sub>C \<in> priv_mem\<^sub>C ! i
[PROOF STEP]
unfolding modes_respect_priv_def new_asms_only_for_priv_def
[PROOF STATE]
proof (prove)
using this:
priv_is_asm_priv mdss \<and> priv_is_guar_priv mdss \<and> (\<forall>i<length cms. ((mdss ! i) AsmNoReadOrWrite \<union> (mdss ! i) AsmNoWrite) \<inter> - range var\<^sub>C_of \<subseteq> priv_mem\<^sub>C ! i) \<and> new_asms_NoReadOrWrite_only mdss
x\<^sub>C \<in> (mdss ! i) AsmNoReadOrWrite
x\<^sub>C \<in> - range var\<^sub>C_of
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
length (conc.restrict_modes ?mdss ?X) = length ?mdss
length mdss = length cms

goal (1 subgoal):
 1. x\<^sub>C \<in> priv_mem\<^sub>C ! i
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
x\<^sub>C \<in> priv_mem\<^sub>C ! i

goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
with respect ilen jlen neq conc.restrict_modes_length len_eq
[PROOF STATE]
proof (chain)
picking this:
modes_respect_priv mdss
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
j < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
j \<noteq> i
length (conc.restrict_modes ?mdss ?X) = length ?mdss
length mdss = length cms
x\<^sub>C \<in> priv_mem\<^sub>C ! i
[PROOF STEP]
have
    "x\<^sub>C \<in> (mdss ! j) GuarNoReadOrWrite"
[PROOF STATE]
proof (prove)
using this:
modes_respect_priv mdss
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
j < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
j \<noteq> i
length (conc.restrict_modes ?mdss ?X) = length ?mdss
length mdss = length cms
x\<^sub>C \<in> priv_mem\<^sub>C ! i

goal (1 subgoal):
 1. x\<^sub>C \<in> (mdss ! j) GuarNoReadOrWrite
[PROOF STEP]
unfolding modes_respect_priv_def priv_is_guar_priv_def
[PROOF STATE]
proof (prove)
using this:
priv_is_asm_priv mdss \<and> (\<forall>i<length cms. \<forall>j<length cms. i \<noteq> j \<longrightarrow> priv_mem\<^sub>C ! i \<subseteq> (mdss ! j) GuarNoReadOrWrite) \<and> new_asms_only_for_priv mdss \<and> new_asms_NoReadOrWrite_only mdss
i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
j < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
j \<noteq> i
length (conc.restrict_modes ?mdss ?X) = length ?mdss
length mdss = length cms
x\<^sub>C \<in> priv_mem\<^sub>C ! i

goal (1 subgoal):
 1. x\<^sub>C \<in> (mdss ! j) GuarNoReadOrWrite
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
x\<^sub>C \<in> (mdss ! j) GuarNoReadOrWrite

goal (1 subgoal):
 1. \<And>i x j. \<lbrakk>length mdss = length cms; modes_respect_priv mdss; i < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! i) AsmNoReadOrWrite; j < length (conc.restrict_modes mdss (- range var\<^sub>C_of)); j \<noteq> i\<rbrakk> \<Longrightarrow> x \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
with jlen xin conc.in_restrict_modesI
[PROOF STATE]
proof (chain)
picking this:
j < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
x\<^sub>C \<in> - range var\<^sub>C_of
\<lbrakk>?i < length ?mdss; ?x \<in> ?X; ?x \<in> (?mdss ! ?i) ?m\<rbrakk> \<Longrightarrow> ?x \<in> (conc.restrict_modes ?mdss ?X ! ?i) ?m
x\<^sub>C \<in> (mdss ! j) GuarNoReadOrWrite
[PROOF STEP]
show
    "x\<^sub>C \<in> (?mdss\<^sub>X ! j) GuarNoReadOrWrite"
[PROOF STATE]
proof (prove)
using this:
j < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
x\<^sub>C \<in> - range var\<^sub>C_of
\<lbrakk>?i < length ?mdss; ?x \<in> ?X; ?x \<in> (?mdss ! ?i) ?m\<rbrakk> \<Longrightarrow> ?x \<in> (conc.restrict_modes ?mdss ?X ! ?i) ?m
x\<^sub>C \<in> (mdss ! j) GuarNoReadOrWrite

goal (1 subgoal):
 1. x\<^sub>C \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
x\<^sub>C \<in> (conc.restrict_modes mdss (- range var\<^sub>C_of) ! j) GuarNoReadOrWrite

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma shows "True" and "False" and "True" and "True"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (True &&& False) &&& True &&& True
[PROOF STEP]
find_proof Simps
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (True &&& False) &&& True &&& True
[PROOF STEP]
oops


[STATEMENT]
lemma reachable_constraints_par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t_aux:
  fixes P
  defines "Ts \<equiv> concat (map transaction_strand P)"
  assumes A: "A \<in> reachable_constraints P"
  shows "\<forall>b \<in> set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t A). \<exists>a \<in> set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and>
      wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and>
      (\<forall>t \<in> subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))"
    (is "\<forall>b \<in> set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t A). \<exists>a \<in> set Ts. ?P b a")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t A). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
using A
[PROOF STATE]
proof (prove)
using this:
A \<in> reachable_constraints P

goal (1 subgoal):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t A). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
proof (induction A rule: reachable_constraints.induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t []). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
 2. \<And>\ T \<xi> \<sigma> \<alpha>. \<lbrakk>\ \<in> reachable_constraints P; \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \; transaction_renaming_subst \<alpha> P \\<rbrakk> \<Longrightarrow> \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
case (step \ T \<xi> \<sigma> \<alpha>)
[PROOF STATE]
proof (state)
this:
\ \<in> reachable_constraints P
T \<in> set P
transaction_decl_subst \<xi> T
transaction_fresh_subst \<sigma> T \
transaction_renaming_subst \<alpha> P \
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))

goal (2 subgoals):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t []). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
 2. \<And>\ T \<xi> \<sigma> \<alpha>. \<lbrakk>\ \<in> reachable_constraints P; \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \; transaction_renaming_subst \<alpha> P \\<rbrakk> \<Longrightarrow> \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
define Q where "Q \<equiv> ?P"
[PROOF STATE]
proof (state)
this:
Q \<equiv> \<lambda>b a. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))

goal (2 subgoals):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t []). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
 2. \<And>\ T \<xi> \<sigma> \<alpha>. \<lbrakk>\ \<in> reachable_constraints P; \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \; transaction_renaming_subst \<alpha> P \\<rbrakk> \<Longrightarrow> \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
define \<theta> where "\<theta> \<equiv> \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>"
[PROOF STATE]
proof (state)
this:
\<theta> \<equiv> \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>

goal (2 subgoals):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t []). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
 2. \<And>\ T \<xi> \<sigma> \<alpha>. \<lbrakk>\ \<in> reachable_constraints P; \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \; transaction_renaming_subst \<alpha> P \\<rbrakk> \<Longrightarrow> \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
let ?R = "\<lambda>A Ts. \<forall>b \<in> set A. \<exists>a \<in> set Ts. Q b a"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t []). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
 2. \<And>\ T \<xi> \<sigma> \<alpha>. \<lbrakk>\ \<in> reachable_constraints P; \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \; transaction_renaming_subst \<alpha> P \\<rbrakk> \<Longrightarrow> \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
have "wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<theta>" "wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<theta>)"
       "\<forall>t \<in> subst_range \<theta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<theta> &&& wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<theta>) &&& \<forall>t\<in>subst_range \<theta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])
[PROOF STEP]
using transaction_decl_fresh_renaming_substs_wt[OF step.hyps(3-5)]
          transaction_decl_fresh_renaming_substs_range_wf_trms[OF step.hyps(3-5)]
          transaction_decl_fresh_renaming_substs_range'(1)[OF step.hyps(3-5)]
[PROOF STATE]
proof (prove)
using this:
wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))
?t \<in> subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \<Longrightarrow> (\<exists>c. ?t = Fun c [] \<and> arity c = 0) \<or> (\<exists>x. ?t = Var x)

goal (1 subgoal):
 1. wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<theta> &&& wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<theta>) &&& \<forall>t\<in>subst_range \<theta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])
[PROOF STEP]
unfolding \<theta>_def
[PROOF STATE]
proof (prove)
using this:
wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))
?t \<in> subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \<Longrightarrow> (\<exists>c. ?t = Fun c [] \<and> arity c = 0) \<or> (\<exists>x. ?t = Var x)

goal (1 subgoal):
 1. wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) &&& wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) &&& \<forall>t\<in>subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>). (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])
[PROOF STEP]
by (metis,metis,fastforce)
[PROOF STATE]
proof (state)
this:
wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<theta>
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<theta>)
\<forall>t\<in>subst_range \<theta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])

goal (2 subgoals):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t []). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
 2. \<And>\ T \<xi> \<sigma> \<alpha>. \<lbrakk>\ \<in> reachable_constraints P; \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \; transaction_renaming_subst \<alpha> P \\<rbrakk> \<Longrightarrow> \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
hence "?R (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T)) \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) (transaction_strand T)"
[PROOF STATE]
proof (prove)
using this:
wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<theta>
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<theta>)
\<forall>t\<in>subst_range \<theta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])

goal (1 subgoal):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T)) \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>). \<exists>a\<in>set (transaction_strand T). Q b a
[PROOF STEP]
using dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t_self_inverse[of "transaction_strand T"]
[PROOF STATE]
proof (prove)
using this:
wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<theta>
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<theta>)
\<forall>t\<in>subst_range \<theta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])
dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T)) = transaction_strand T

goal (1 subgoal):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T)) \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>). \<exists>a\<in>set (transaction_strand T). Q b a
[PROOF STEP]
by (auto simp add: Q_def subst_apply_labeled_stateful_strand_def)
[PROOF STATE]
proof (state)
this:
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T)) \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>). \<exists>a\<in>set (transaction_strand T). Q b a

goal (2 subgoals):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t []). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
 2. \<And>\ T \<xi> \<sigma> \<alpha>. \<lbrakk>\ \<in> reachable_constraints P; \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \; transaction_renaming_subst \<alpha> P \\<rbrakk> \<Longrightarrow> \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
hence "?R (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))) (transaction_strand T)"
[PROOF STATE]
proof (prove)
using this:
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T)) \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>). \<exists>a\<in>set (transaction_strand T). Q b a

goal (1 subgoal):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))). \<exists>a\<in>set (transaction_strand T). Q b a
[PROOF STEP]
by (metis dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t_subst)
[PROOF STATE]
proof (state)
this:
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))). \<exists>a\<in>set (transaction_strand T). Q b a

goal (2 subgoals):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t []). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
 2. \<And>\ T \<xi> \<sigma> \<alpha>. \<lbrakk>\ \<in> reachable_constraints P; \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \; transaction_renaming_subst \<alpha> P \\<rbrakk> \<Longrightarrow> \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
hence "?R (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))) Ts"
[PROOF STATE]
proof (prove)
using this:
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))). \<exists>a\<in>set (transaction_strand T). Q b a

goal (1 subgoal):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))). \<exists>a\<in>set Ts. Q b a
[PROOF STEP]
using step.hyps(2)
[PROOF STATE]
proof (prove)
using this:
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))). \<exists>a\<in>set (transaction_strand T). Q b a
T \<in> set P

goal (1 subgoal):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))). \<exists>a\<in>set Ts. Q b a
[PROOF STEP]
unfolding Ts_def dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t_def
[PROOF STATE]
proof (prove)
using this:
\<forall>b\<in>set (map dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p (map dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))). \<exists>a\<in>set (transaction_strand T). Q b a
T \<in> set P

goal (1 subgoal):
 1. \<forall>b\<in>set (map dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p (map dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))). \<exists>a\<in>set (concat (map transaction_strand P)). Q b a
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))). \<exists>a\<in>set Ts. Q b a

goal (2 subgoals):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t []). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
 2. \<And>\ T \<xi> \<sigma> \<alpha>. \<lbrakk>\ \<in> reachable_constraints P; \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c [])); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \; transaction_renaming_subst \<alpha> P \\<rbrakk> \<Longrightarrow> \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))). \<exists>a\<in>set Ts. Q b a

goal (1 subgoal):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
using step.IH
[PROOF STATE]
proof (prove)
using this:
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))). \<exists>a\<in>set Ts. Q b a
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))

goal (1 subgoal):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
unfolding Q_def \<theta>_def
[PROOF STATE]
proof (prove)
using this:
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t \). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))

goal (1 subgoal):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))

goal (1 subgoal):
 1. \<forall>b\<in>set (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t []). \<exists>a\<in>set Ts. \<exists>\<delta>. b = a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta> \<and> wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and> (\<forall>t\<in>subst_range \<delta>. (\<exists>x. t = Var x) \<or> (\<exists>c. t = Fun c []))
[PROOF STEP]
qed simp


[STATEMENT]
lemma  "coclop (f::'a set \<Rightarrow> 'a set) \<Longrightarrow> f \<top> = \<top>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. coclop f \<Longrightarrow> top_pres f
[PROOF STEP]
(*nitpick *)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. coclop f \<Longrightarrow> top_pres f
[PROOF STEP]
oops


[STATEMENT]
lemma inline1_inline_conv_inline2':
  "inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1) =
   map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. bind_gpv (rpv'' r)
       (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv)))
     (inline2 gpv s2 s1)"
  (is "?lhs = ?rhs")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1) = map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1)
[PROOF STEP]
proof(rule spmf.leq_antisym)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. ord_spmf (=) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1)) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))
 2. ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1)) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))
[PROOF STEP]
show "ord_spmf (=) ?lhs ?rhs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ord_spmf (=) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1)) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))
[PROOF STEP]
proof(induction arbitrary: gpv s2 s1 rule: inline1_fixp_induct)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. spmf.admissible (\<lambda>inline1'. \<forall>x xa xb. ord_spmf (=) (inline1' (x, xa, xb)) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 x xa xb)))
 2. \<And>gpv s2 s1. ord_spmf (=) (return_pmf None) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))
 3. \<And>inline1' gpv s2 s1. (\<And>gpv s2 s1. ord_spmf (=) (inline1' gpv (s2, s1)) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))) \<Longrightarrow> ord_spmf (=) (the_gpv gpv \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2, s1))) (\<lambda>out rpv. the_gpv ((case (s2, s1) of (s2, s1) \<Rightarrow> \<lambda>c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) out) \<bind> case_generat (\<lambda>(x, y). inline1' (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv))))) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))
[PROOF STEP]
case (step inline1')
[PROOF STATE]
proof (state)
this:
ord_spmf (=) (inline1' ?gpv1 (?s2.1, ?s1.1)) (map_spmf (map_sum id (\<lambda>a. case a of (x, rpv'', rpv', rpv) \<Rightarrow> (x, \<lambda>r. rpv'' r \<bind> (\<lambda>a. case a of (r1, s1) \<Rightarrow> map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r2, s2) \<Rightarrow> \<lambda>s1. (r2, s2, s1)) b) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 ?gpv1 ?s2.1 ?s1.1))

goal (3 subgoals):
 1. spmf.admissible (\<lambda>inline1'. \<forall>x xa xb. ord_spmf (=) (inline1' (x, xa, xb)) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 x xa xb)))
 2. \<And>gpv s2 s1. ord_spmf (=) (return_pmf None) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))
 3. \<And>inline1' gpv s2 s1. (\<And>gpv s2 s1. ord_spmf (=) (inline1' gpv (s2, s1)) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))) \<Longrightarrow> ord_spmf (=) (the_gpv gpv \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2, s1))) (\<lambda>out rpv. the_gpv ((case (s2, s1) of (s2, s1) \<Rightarrow> \<lambda>c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) out) \<bind> case_generat (\<lambda>(x, y). inline1' (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv))))) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ord_spmf (=) (the_gpv gpv \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2, s1))) (\<lambda>out rpv. the_gpv ((case (s2, s1) of (s2, s1) \<Rightarrow> \<lambda>c2. map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r, s2) \<Rightarrow> \<lambda>s1. (r, s2, s1)) b) id (inline callee1 (callee2 s2 c2) s1)) out) \<bind> case_generat (\<lambda>(x, y). inline1' (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv))))) (map_spmf (map_sum id (\<lambda>a. case a of (x, rpv'', rpv', rpv) \<Rightarrow> (x, \<lambda>r. rpv'' r \<bind> (\<lambda>a. case a of (r1, s1) \<Rightarrow> map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r2, s2) \<Rightarrow> \<lambda>s1. (r2, s2, s1)) b) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))
[PROOF STEP]
by(rewrite inline2.simps)(auto simp add: map_spmf_bind_spmf o_def inline_sel gpv.map_sel bind_map_spmf id_def[symmetric] gpv.map_id map_gpv_bind_gpv split_def intro!: ord_spmf_bind_reflI step.IH[THEN spmf.leq_trans] split: generat.split sum.split)
[PROOF STATE]
proof (state)
this:
ord_spmf (=) (the_gpv gpv \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2, s1))) (\<lambda>out rpv. the_gpv ((case (s2, s1) of (s2, s1) \<Rightarrow> \<lambda>c2. map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r, s2) \<Rightarrow> \<lambda>s1. (r, s2, s1)) b) id (inline callee1 (callee2 s2 c2) s1)) out) \<bind> case_generat (\<lambda>(x, y). inline1' (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv))))) (map_spmf (map_sum id (\<lambda>a. case a of (x, rpv'', rpv', rpv) \<Rightarrow> (x, \<lambda>r. rpv'' r \<bind> (\<lambda>a. case a of (r1, s1) \<Rightarrow> map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r2, s2) \<Rightarrow> \<lambda>s1. (r2, s2, s1)) b) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))

goal (2 subgoals):
 1. spmf.admissible (\<lambda>inline1'. \<forall>x xa xb. ord_spmf (=) (inline1' (x, xa, xb)) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 x xa xb)))
 2. \<And>gpv s2 s1. ord_spmf (=) (return_pmf None) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))
[PROOF STEP]
qed simp_all
[PROOF STATE]
proof (state)
this:
ord_spmf (=) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1)) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1))

goal (1 subgoal):
 1. ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1)) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))
[PROOF STEP]
show "ord_spmf (=) ?rhs ?lhs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1)) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))
[PROOF STEP]
proof(induction arbitrary: gpv s2 s1 rule: inline2_fixp_induct)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. spmf.admissible (\<lambda>inline2. \<forall>x xa xb. ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (inline2 ((x, xa), xb))) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) x (xa, xb)))
 2. \<And>gpv s2 s1. ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (return_pmf None)) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))
 3. \<And>inline2' gpv s2 s1. (\<And>gpv s2 s1. ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (inline2' gpv s2 s1)) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))) \<Longrightarrow> ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (the_gpv gpv \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2, s1))) (\<lambda>out rpv. inline1 callee1 (callee2 s2 out) s1 \<bind> case_sum (\<lambda>(a, c). case a of (r2, s2) \<Rightarrow> inline2' (rpv r2) s2 c) (\<lambda>(x, rpv'', rpv'). return_spmf (Inr (x, rpv'', rpv', rpv)))))) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))
[PROOF STEP]
case (step inline2')
[PROOF STATE]
proof (state)
this:
ord_spmf (=) (map_spmf (map_sum id (\<lambda>a. case a of (x, rpv'', rpv', rpv) \<Rightarrow> (x, \<lambda>r. rpv'' r \<bind> (\<lambda>a. case a of (r1, s1) \<Rightarrow> map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r2, s2) \<Rightarrow> \<lambda>s1. (r2, s2, s1)) b) id (inline callee1 (rpv' r1) s1)), rpv))) (inline2' ?gpv1 ?s2.1 ?s1.1)) (inline1 (\<lambda>a. case a of (s2, s1) \<Rightarrow> \<lambda>c2. map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r, s2) \<Rightarrow> \<lambda>s1. (r, s2, s1)) b) id (inline callee1 (callee2 s2 c2) s1)) ?gpv1 (?s2.1, ?s1.1))

goal (3 subgoals):
 1. spmf.admissible (\<lambda>inline2. \<forall>x xa xb. ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (inline2 ((x, xa), xb))) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) x (xa, xb)))
 2. \<And>gpv s2 s1. ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (return_pmf None)) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))
 3. \<And>inline2' gpv s2 s1. (\<And>gpv s2 s1. ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (inline2' gpv s2 s1)) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))) \<Longrightarrow> ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (the_gpv gpv \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2, s1))) (\<lambda>out rpv. inline1 callee1 (callee2 s2 out) s1 \<bind> case_sum (\<lambda>(a, c). case a of (r2, s2) \<Rightarrow> inline2' (rpv r2) s2 c) (\<lambda>(x, rpv'', rpv'). return_spmf (Inr (x, rpv'', rpv', rpv)))))) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ord_spmf (=) (map_spmf (map_sum id (\<lambda>a. case a of (x, rpv'', rpv', rpv) \<Rightarrow> (x, \<lambda>r. rpv'' r \<bind> (\<lambda>a. case a of (r1, s1) \<Rightarrow> map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r2, s2) \<Rightarrow> \<lambda>s1. (r2, s2, s1)) b) id (inline callee1 (rpv' r1) s1)), rpv))) (the_gpv gpv \<bind> (\<lambda>generat. case generat of Pure x \<Rightarrow> return_spmf (Inl (x, s2, s1)) | IO out rpv \<Rightarrow> inline1 callee1 (callee2 s2 out) s1 \<bind> (\<lambda>lr. case lr of Inl ((r2, s2), c) \<Rightarrow> inline2' (rpv r2) s2 c | Inr (x, rpv'', rpv') \<Rightarrow> return_spmf (Inr (x, rpv'', rpv', rpv)))))) (inline1 (\<lambda>a. case a of (s2, s1) \<Rightarrow> \<lambda>c2. map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r, s2) \<Rightarrow> \<lambda>s1. (r, s2, s1)) b) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))
[PROOF STEP]
apply(rewrite in "ord_spmf _ _ \<hole>" inline1.simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ord_spmf (=) (map_spmf (map_sum id (\<lambda>a. case a of (x, rpv'', rpv', rpv) \<Rightarrow> (x, \<lambda>r. rpv'' r \<bind> (\<lambda>a. case a of (r1, s1) \<Rightarrow> map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r2, s2) \<Rightarrow> \<lambda>s1. (r2, s2, s1)) b) id (inline callee1 (rpv' r1) s1)), rpv))) (the_gpv gpv \<bind> (\<lambda>generat. case generat of Pure x \<Rightarrow> return_spmf (Inl (x, s2, s1)) | IO out rpv \<Rightarrow> inline1 callee1 (callee2 s2 out) s1 \<bind> (\<lambda>lr. case lr of Inl ((r2, s2), c) \<Rightarrow> inline2' (rpv r2) s2 c | Inr (x, rpv'', rpv') \<Rightarrow> return_spmf (Inr (x, rpv'', rpv', rpv)))))) (the_gpv gpv \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2, s1))) (\<lambda>out rpv. the_gpv ((case (s2, s1) of (s2, s1) \<Rightarrow> \<lambda>c2. map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r, s2) \<Rightarrow> \<lambda>s1. (r, s2, s1)) b) id (inline callee1 (callee2 s2 c2) s1)) out) \<bind> case_generat (\<lambda>(x, y). inline1 (\<lambda>a. case a of (s2, s1) \<Rightarrow> \<lambda>c2. map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r, s2) \<Rightarrow> \<lambda>s1. (r, s2, s1)) b) id (inline callee1 (callee2 s2 c2) s1)) (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv)))))
[PROOF STEP]
apply(clarsimp simp add: map_spmf_bind_spmf bind_rpv_def o_def gpv.map_sel bind_map_spmf inline_sel map_gpv_bind_gpv id_def[symmetric] gpv.map_id split_def split: generat.split sum.split intro!: ord_spmf_bind_reflI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 a b ba. \<lbrakk>IO x21 x22 \<in> set_spmf (the_gpv gpv); Inl ((a, b), ba) \<in> set_spmf (inline1 callee1 (callee2 s2 x21) s1)\<rbrakk> \<Longrightarrow> ord_spmf (=) (map_spmf (map_sum id (\<lambda>a. (fst a, \<lambda>r. fst (snd a) r \<bind> (\<lambda>b. map_gpv (\<lambda>a. (fst (fst a), snd (fst a), snd a)) id (inline callee1 (fst (snd (snd a)) (fst b)) (snd b))), snd (snd (snd a))))) (inline2' (x22 a) b ba)) (inline1 (\<lambda>a b. map_gpv (\<lambda>a. (fst (fst a), snd (fst a), snd a)) id (inline callee1 (callee2 (fst a) b) (snd a))) (x22 a) (b, ba))
[PROOF STEP]
apply(rule spmf.leq_trans[OF spmf.leq_trans, OF _ step.IH])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 a b ba. \<lbrakk>IO x21 x22 \<in> set_spmf (the_gpv gpv); Inl ((a, b), ba) \<in> set_spmf (inline1 callee1 (callee2 s2 x21) s1)\<rbrakk> \<Longrightarrow> ord_spmf (=) (map_spmf (map_sum id (\<lambda>a. (fst a, \<lambda>r. fst (snd a) r \<bind> (\<lambda>aa. map_gpv (\<lambda>a. (fst (fst a), snd (fst a), snd a)) id (inline callee1 (fst (snd (snd a)) (fst aa)) (snd aa))), snd (snd (snd a))))) (inline2' (x22 a) b ba)) (map_spmf (map_sum id (\<lambda>a. case a of (x, rpv'', rpv', rpv) \<Rightarrow> (x, \<lambda>r. rpv'' r \<bind> (\<lambda>a. case a of (r1, s1) \<Rightarrow> map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r2, s2) \<Rightarrow> \<lambda>s1. (r2, s2, s1)) b) id (inline callee1 (rpv' r1) s1)), rpv))) (inline2' (?gpv29 x21 x22 a b ba) (?s2.29 x21 x22 a b ba) (?s1.29 x21 x22 a b ba)))
 2. \<And>x21 x22 a b ba. \<lbrakk>IO x21 x22 \<in> set_spmf (the_gpv gpv); Inl ((a, b), ba) \<in> set_spmf (inline1 callee1 (callee2 s2 x21) s1)\<rbrakk> \<Longrightarrow> ord_spmf (=) (inline1 (\<lambda>a. case a of (s2, s1) \<Rightarrow> \<lambda>c2. map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r, s2) \<Rightarrow> \<lambda>s1. (r, s2, s1)) b) id (inline callee1 (callee2 s2 c2) s1)) (?gpv29 x21 x22 a b ba) (?s2.29 x21 x22 a b ba, ?s1.29 x21 x22 a b ba)) (inline1 (\<lambda>a aa. map_gpv (\<lambda>a. (fst (fst a), snd (fst a), snd a)) id (inline callee1 (callee2 (fst a) aa) (snd a))) (x22 a) (b, ba))
[PROOF STEP]
apply(auto simp add: split_def id_def[symmetric] intro!: ord_spmf_reflI)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
ord_spmf (=) (map_spmf (map_sum id (\<lambda>a. case a of (x, rpv'', rpv', rpv) \<Rightarrow> (x, \<lambda>r. rpv'' r \<bind> (\<lambda>a. case a of (r1, s1) \<Rightarrow> map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r2, s2) \<Rightarrow> \<lambda>s1. (r2, s2, s1)) b) id (inline callee1 (rpv' r1) s1)), rpv))) (the_gpv gpv \<bind> (\<lambda>generat. case generat of Pure x \<Rightarrow> return_spmf (Inl (x, s2, s1)) | IO out rpv \<Rightarrow> inline1 callee1 (callee2 s2 out) s1 \<bind> (\<lambda>lr. case lr of Inl ((r2, s2), c) \<Rightarrow> inline2' (rpv r2) s2 c | Inr (x, rpv'', rpv') \<Rightarrow> return_spmf (Inr (x, rpv'', rpv', rpv)))))) (inline1 (\<lambda>a. case a of (s2, s1) \<Rightarrow> \<lambda>c2. map_gpv (\<lambda>a. case a of (a, b) \<Rightarrow> (case a of (r, s2) \<Rightarrow> \<lambda>s1. (r, s2, s1)) b) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))

goal (2 subgoals):
 1. spmf.admissible (\<lambda>inline2. \<forall>x xa xb. ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (inline2 ((x, xa), xb))) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) x (xa, xb)))
 2. \<And>gpv s2 s1. ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (return_pmf None)) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))
[PROOF STEP]
qed simp_all
[PROOF STATE]
proof (state)
this:
ord_spmf (=) (map_spmf (map_sum id (\<lambda>(x, rpv'', rpv', rpv). (x, \<lambda>r. rpv'' r \<bind> (\<lambda>(r1, s1). map_gpv (\<lambda>((r2, s2), s1). (r2, s2, s1)) id (inline callee1 (rpv' r1) s1)), rpv))) (local.inline2 gpv s2 s1)) (inline1 (\<lambda>(s2, s1) c2. map_gpv (\<lambda>((r, s2), s1). (r, s2, s1)) id (inline callee1 (callee2 s2 c2) s1)) gpv (s2, s1))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma DynProc':
  assumes adapt: "P \<subseteq> {s. \<exists>Z. init s \<in> P' s Z \<and>
                          (\<forall>t \<in> Q' s Z. return s t \<in> R s t) \<and>
                          (\<forall>t \<in> A' s Z. return s t \<in> A)}"
  assumes c: "\<forall>s t. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F\<^esub> (R s t) (c s t) Q,A"
  assumes p: "\<forall>s\<in> P. \<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)"
  shows "\<Gamma>,\<Theta>\<turnstile>\<^bsub>/F\<^esub> P dynCall init p return c Q,A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>P dynCall init p return c Q,A
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>P dynCall init p return c Q,A
[PROOF STEP]
from adapt
[PROOF STATE]
proof (chain)
picking this:
P \<subseteq> {s. \<exists>Z. init s \<in> P' s Z \<and> (\<forall>t\<in>Q' s Z. return s t \<in> R s t) \<and> (\<forall>t\<in>A' s Z. return s t \<in> A)}
[PROOF STEP]
have "P \<subseteq> {s. \<exists>Z. init s \<in> P' s Z \<and>
                          (\<forall>t. t \<in> Q' s Z \<longrightarrow>  return s t \<in> R s t) \<and>
                          (\<forall>t. t \<in> A' s Z \<longrightarrow> return s t \<in> A)}"
[PROOF STATE]
proof (prove)
using this:
P \<subseteq> {s. \<exists>Z. init s \<in> P' s Z \<and> (\<forall>t\<in>Q' s Z. return s t \<in> R s t) \<and> (\<forall>t\<in>A' s Z. return s t \<in> A)}

goal (1 subgoal):
 1. P \<subseteq> {s. \<exists>Z. init s \<in> P' s Z \<and> (\<forall>t. t \<in> Q' s Z \<longrightarrow> return s t \<in> R s t) \<and> (\<forall>t. t \<in> A' s Z \<longrightarrow> return s t \<in> A)}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
P \<subseteq> {s. \<exists>Z. init s \<in> P' s Z \<and> (\<forall>t. t \<in> Q' s Z \<longrightarrow> return s t \<in> R s t) \<and> (\<forall>t. t \<in> A' s Z \<longrightarrow> return s t \<in> A)}

goal (1 subgoal):
 1. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>P dynCall init p return c Q,A
[PROOF STEP]
from this c p
[PROOF STATE]
proof (chain)
picking this:
P \<subseteq> {s. \<exists>Z. init s \<in> P' s Z \<and> (\<forall>t. t \<in> Q' s Z \<longrightarrow> return s t \<in> R s t) \<and> (\<forall>t. t \<in> A' s Z \<longrightarrow> return s t \<in> A)}
\<forall>s t. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>(R s t) c s t Q,A
\<forall>s\<in>P. \<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>(P' s Z) Call (p s) (Q' s Z),(A' s Z)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
P \<subseteq> {s. \<exists>Z. init s \<in> P' s Z \<and> (\<forall>t. t \<in> Q' s Z \<longrightarrow> return s t \<in> R s t) \<and> (\<forall>t. t \<in> A' s Z \<longrightarrow> return s t \<in> A)}
\<forall>s t. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>(R s t) c s t Q,A
\<forall>s\<in>P. \<forall>Z. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>(P' s Z) Call (p s) (Q' s Z),(A' s Z)

goal (1 subgoal):
 1. \<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>P dynCall init p return c Q,A
[PROOF STEP]
by (rule DynProc)
[PROOF STATE]
proof (state)
this:
\<Gamma>,\<Theta>\<turnstile>\<^bsub>/F \<^esub>P dynCall init p return c Q,A

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "XCoP \<eta> \<Longrightarrow> CoP2 \<eta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. XCoP \<eta> \<Longrightarrow> CoP2 \<eta>
[PROOF STEP]
nitpick
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. XCoP \<eta> \<Longrightarrow> CoP2 \<eta>
[PROOF STEP]
oops


[STATEMENT]
lemma (in TC0) after_in_states:
assumes wf: "wf_prog p P" and wt: "P,E \<turnstile>\<^sub>1 e :: T"
  and Etypes: "set E \<subseteq> types P" and STtypes: "set ST \<subseteq> types P"
  and stack: "size ST + max_stack e \<le> mxs"
shows "OK (after E A ST e) \<in> states P mxs mxl"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OK (after E A ST e) \<in> states P mxs mxl
[PROOF STEP]
(*<*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OK (after E A ST e) \<in> states P mxs mxl
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. OK (after E A ST e) \<in> states P mxs mxl
[PROOF STEP]
have "size ST + 1 \<le> mxs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length ST + 1 \<le> mxs
[PROOF STEP]
using max_stack1[of e] wt stack
[PROOF STATE]
proof (prove)
using this:
1 \<le> max_stack e
P,E \<turnstile>\<^sub>1 e :: T
length ST + max_stack e \<le> mxs

goal (1 subgoal):
 1. length ST + 1 \<le> mxs
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
length ST + 1 \<le> mxs

goal (1 subgoal):
 1. OK (after E A ST e) \<in> states P mxs mxl
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
length ST + 1 \<le> mxs
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
length ST + 1 \<le> mxs

goal (1 subgoal):
 1. OK (after E A ST e) \<in> states P mxs mxl
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
length ST + 1 \<le> mxs
wf_prog p P
P,E \<turnstile>\<^sub>1 e :: T
set E \<subseteq> types P
set ST \<subseteq> types P
length ST + max_stack e \<le> mxs

goal (1 subgoal):
 1. OK (after E A ST e) \<in> states P mxs mxl
[PROOF STEP]
by(simp add: after_def ty\<^sub>i'_def JVM_states_unfold ty\<^sub>l_in_types)
      (blast intro!:nlistsI WT\<^sub>1_is_type)
[PROOF STATE]
proof (state)
this:
OK (after E A ST e) \<in> states P mxs mxl

goal:
No subgoals!
[PROOF STEP]
qed