[STATEMENT]
lemma \<tau>diverge_\<tau>mredTD:
  assumes div: "mthr.\<tau>diverge s"
  and fin: "finite (dom (thr s))"
  shows "\<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
using fin div
[PROOF STATE]
proof (prove)
using this:
finite (dom (thr s))
mthr.\<tau>diverge s

goal (1 subgoal):
 1. \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
proof(induct A\<equiv>"dom (thr s)" arbitrary: s rule: finite_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>{} = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
 2. \<And>x F s. \<lbrakk>finite F; x \<notin> F; \<And>s. \<lbrakk>F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s); insert x F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
case empty
[PROOF STATE]
proof (state)
this:
{} = dom (thr s)
mthr.\<tau>diverge s

goal (2 subgoals):
 1. \<And>s. \<lbrakk>{} = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
 2. \<And>x F s. \<lbrakk>finite F; x \<notin> F; \<And>s. \<lbrakk>F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s); insert x F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
from \<open>mthr.\<tau>diverge s\<close>
[PROOF STATE]
proof (chain)
picking this:
mthr.\<tau>diverge s
[PROOF STEP]
obtain s' where "\<tau>mredT s s'"
[PROOF STATE]
proof (prove)
using this:
mthr.\<tau>diverge s

goal (1 subgoal):
 1. (\<And>s'. \<tau>mredT s s' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by cases auto
[PROOF STATE]
proof (state)
this:
\<tau>mredT s s'

goal (2 subgoals):
 1. \<And>s. \<lbrakk>{} = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
 2. \<And>x F s. \<lbrakk>finite F; x \<notin> F; \<And>s. \<lbrakk>F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s); insert x F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
with \<open>{} = dom (thr s)\<close>[symmetric]
[PROOF STATE]
proof (chain)
picking this:
dom (thr s) = {}
\<tau>mredT s s'
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
dom (thr s) = {}
\<tau>mredT s s'

goal (1 subgoal):
 1. False
[PROOF STEP]
by(auto elim!: mthr.silent_move.cases redT.cases)
[PROOF STATE]
proof (state)
this:
False

goal (2 subgoals):
 1. \<And>s. \<lbrakk>{} = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
 2. \<And>x F s. \<lbrakk>finite F; x \<notin> F; \<And>s. \<lbrakk>F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s); insert x F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)

goal (1 subgoal):
 1. \<And>x F s. \<lbrakk>finite F; x \<notin> F; \<And>s. \<lbrakk>F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s); insert x F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x F s. \<lbrakk>finite F; x \<notin> F; \<And>s. \<lbrakk>F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s); insert x F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
case (insert t A)
[PROOF STATE]
proof (state)
this:
finite A
t \<notin> A
\<lbrakk>A = dom (thr ?s12); mthr.\<tau>diverge ?s12\<rbrakk> \<Longrightarrow> \<exists>t x. thr ?s12 t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset ?s12 t = None \<and> \<tau>diverge t (x, shr ?s12)
insert t A = dom (thr s)
mthr.\<tau>diverge s

goal (1 subgoal):
 1. \<And>x F s. \<lbrakk>finite F; x \<notin> F; \<And>s. \<lbrakk>F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s); insert x F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
note IH = \<open>\<And>s. \<lbrakk> A = dom (thr s); mthr.\<tau>diverge s \<rbrakk>
             \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)\<close>
[PROOF STATE]
proof (state)
this:
\<lbrakk>A = dom (thr ?s); mthr.\<tau>diverge ?s\<rbrakk> \<Longrightarrow> \<exists>t x. thr ?s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset ?s t = None \<and> \<tau>diverge t (x, shr ?s)

goal (1 subgoal):
 1. \<And>x F s. \<lbrakk>finite F; x \<notin> F; \<And>s. \<lbrakk>F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s); insert x F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
from \<open>insert t A = dom (thr s)\<close>
[PROOF STATE]
proof (chain)
picking this:
insert t A = dom (thr s)
[PROOF STEP]
obtain x ln where tst: "thr s t = \<lfloor>(x, ln)\<rfloor>"
[PROOF STATE]
proof (prove)
using this:
insert t A = dom (thr s)

goal (1 subgoal):
 1. (\<And>x ln. thr s t = \<lfloor>(x, ln)\<rfloor> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce simp add: dom_def)
[PROOF STATE]
proof (state)
this:
thr s t = \<lfloor>(x, ln)\<rfloor>

goal (1 subgoal):
 1. \<And>x F s. \<lbrakk>finite F; x \<notin> F; \<And>s. \<lbrakk>F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s); insert x F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
define s' where "s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s)"
[PROOF STATE]
proof (state)
this:
s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s)

goal (1 subgoal):
 1. \<And>x F s. \<lbrakk>finite F; x \<notin> F; \<And>s. \<lbrakk>F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s); insert x F = dom (thr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
proof(cases "ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
 2. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None

goal (2 subgoals):
 1. ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
 2. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
with tst
[PROOF STATE]
proof (chain)
picking this:
thr s t = \<lfloor>(x, ln)\<rfloor>
ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
thr s t = \<lfloor>(x, ln)\<rfloor>
ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None

goal (1 subgoal):
 1. \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None)

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
define xm where "xm = (x, shr s)"
[PROOF STATE]
proof (state)
this:
xm = (x, shr s)

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
define xm' where "xm' = (x, shr s)"
[PROOF STATE]
proof (state)
this:
xm' = (x, shr s)

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
have "A = dom (thr s')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A = dom (thr s')
[PROOF STEP]
using \<open>t \<notin> A\<close> \<open>insert t A = dom (thr s)\<close>
[PROOF STATE]
proof (prove)
using this:
t \<notin> A
insert t A = dom (thr s)

goal (1 subgoal):
 1. A = dom (thr s')
[PROOF STEP]
unfolding s'_def
[PROOF STATE]
proof (prove)
using this:
t \<notin> A
insert t A = dom (thr s)

goal (1 subgoal):
 1. A = dom (thr (locks s, ((thr s)(t := None), shr s), wset s, interrupts s))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
A = dom (thr s')

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
A = dom (thr s')

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
A = dom (thr s')

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
from xm'_def tst \<open>mthr.\<tau>diverge s\<close> False
[PROOF STATE]
proof (chain)
picking this:
xm' = (x, shr s)
thr s t = \<lfloor>(x, ln)\<rfloor>
mthr.\<tau>diverge s
\<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None)
[PROOF STEP]
have "\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and>
                  s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> xm = (x, shr s) \<and>
                  mthr.\<tau>diverge s \<and> silent_moves t xm' xm"
[PROOF STATE]
proof (prove)
using this:
xm' = (x, shr s)
thr s t = \<lfloor>(x, ln)\<rfloor>
mthr.\<tau>diverge s
\<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None)

goal (1 subgoal):
 1. \<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> xm = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' xm
[PROOF STEP]
unfolding s'_def xm_def
[PROOF STATE]
proof (prove)
using this:
xm' = (x, shr s)
thr s t = \<lfloor>(x, ln)\<rfloor>
mthr.\<tau>diverge s
\<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None)

goal (1 subgoal):
 1. \<exists>s xa. thr s t = \<lfloor>(xa, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> (x, shr s) = (xa, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' (x, shr s)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> xm = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' xm

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> xm = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' xm

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
from False
[PROOF STATE]
proof (chain)
picking this:
\<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None)
[PROOF STEP]
have "wfP (if \<tau>diverge t xm' then (\<lambda>s s'. False) else flip (silent_move_from t xm'))"
[PROOF STATE]
proof (prove)
using this:
\<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None)

goal (1 subgoal):
 1. wfP (if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm'))
[PROOF STEP]
using \<tau>diverge_neq_wfP_silent_move_from[of t "(x, shr s)"]
[PROOF STATE]
proof (prove)
using this:
\<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None)
\<tau>diverge t (x, shr s) \<noteq> wfP (flip (silent_move_from t (x, shr s)))

goal (1 subgoal):
 1. wfP (if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm'))
[PROOF STEP]
unfolding xm'_def
[PROOF STATE]
proof (prove)
using this:
\<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None)
\<tau>diverge t (x, shr s) \<noteq> wfP (flip (silent_move_from t (x, shr s)))

goal (1 subgoal):
 1. wfP (if \<tau>diverge t (x, shr s) then \<lambda>s s'. False else flip (silent_move_from t (x, shr s)))
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
wfP (if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm'))

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> xm = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' xm
wfP (if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm'))
[PROOF STEP]
have "mthr.\<tau>diverge s'"
[PROOF STATE]
proof (prove)
using this:
\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> xm = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' xm
wfP (if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm'))

goal (1 subgoal):
 1. mthr.\<tau>diverge s'
[PROOF STEP]
proof(coinduct s' xm rule: mthr.\<tau>diverge_trancl_measure_coinduct)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>s ta. \<exists>sa x. thr sa t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset sa t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s = (locks sa, ((thr sa)(t := None), shr sa), wset sa, interrupts sa) \<and> ta = (x, shr sa) \<and> mthr.\<tau>diverge sa \<and> silent_moves t xm' ta \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' ta \<and> s' = s \<or> mthr.silent_movet s s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
case (\<tau>diverge s' xm)
[PROOF STATE]
proof (state)
this:
\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> xm = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' xm

goal (1 subgoal):
 1. \<And>s ta. \<exists>sa x. thr sa t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset sa t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s = (locks sa, ((thr sa)(t := None), shr sa), wset sa, interrupts sa) \<and> ta = (x, shr sa) \<and> mthr.\<tau>diverge sa \<and> silent_moves t xm' ta \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' ta \<and> s' = s \<or> mthr.silent_movet s s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> xm = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' xm
[PROOF STEP]
obtain s x where tst: "thr s t = \<lfloor>(x, ln)\<rfloor>"
          and blocked: "ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm'"
          and s'_def: "s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s)"
          and xm_def: "xm = (x, shr s)"
          and xmxm': "silent_moves t xm' (x, shr s)"
          and "mthr.\<tau>diverge s"
[PROOF STATE]
proof (prove)
using this:
\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> xm = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' xm

goal (1 subgoal):
 1. (\<And>s x. \<lbrakk>thr s t = \<lfloor>(x, ln)\<rfloor>; ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm'; s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s); xm = (x, shr s); silent_moves t xm' (x, shr s); mthr.\<tau>diverge s\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
thr s t = \<lfloor>(x, ln)\<rfloor>
ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm'
s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s)
xm = (x, shr s)
silent_moves t xm' (x, shr s)
mthr.\<tau>diverge s

goal (1 subgoal):
 1. \<And>s ta. \<exists>sa x. thr sa t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset sa t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s = (locks sa, ((thr sa)(t := None), shr sa), wset sa, interrupts sa) \<and> ta = (x, shr sa) \<and> mthr.\<tau>diverge sa \<and> silent_moves t xm' ta \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' ta \<and> s' = s \<or> mthr.silent_movet s s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
from \<open>mthr.\<tau>diverge s\<close>
[PROOF STATE]
proof (chain)
picking this:
mthr.\<tau>diverge s
[PROOF STEP]
obtain s'' where "\<tau>mredT s s''" "mthr.\<tau>diverge s''"
[PROOF STATE]
proof (prove)
using this:
mthr.\<tau>diverge s

goal (1 subgoal):
 1. (\<And>s''. \<lbrakk>\<tau>mredT s s''; mthr.\<tau>diverge s''\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by cases auto
[PROOF STATE]
proof (state)
this:
\<tau>mredT s s''
mthr.\<tau>diverge s''

goal (1 subgoal):
 1. \<And>s ta. \<exists>sa x. thr sa t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset sa t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s = (locks sa, ((thr sa)(t := None), shr sa), wset sa, interrupts sa) \<and> ta = (x, shr sa) \<and> mthr.\<tau>diverge sa \<and> silent_moves t xm' ta \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' ta \<and> s' = s \<or> mthr.silent_movet s s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
from \<open>\<tau>mredT s s''\<close>
[PROOF STATE]
proof (chain)
picking this:
\<tau>mredT s s''
[PROOF STEP]
obtain t' ta where "s -t'\<triangleright>ta\<rightarrow> s''" and "m\<tau>move s (t', ta) s''"
[PROOF STATE]
proof (prove)
using this:
\<tau>mredT s s''

goal (1 subgoal):
 1. (\<And>t' ta. \<lbrakk>s -t'\<triangleright>ta\<rightarrow> s''; m\<tau>move s (t', ta) s''\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
s -t'\<triangleright>ta\<rightarrow> s''
m\<tau>move s (t', ta) s''

goal (1 subgoal):
 1. \<And>s ta. \<exists>sa x. thr sa t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset sa t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s = (locks sa, ((thr sa)(t := None), shr sa), wset sa, interrupts sa) \<and> ta = (x, shr sa) \<and> mthr.\<tau>diverge sa \<and> silent_moves t xm' ta \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' ta \<and> s' = s \<or> mthr.silent_movet s s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
s -t'\<triangleright>ta\<rightarrow> s''
m\<tau>move s (t', ta) s''
[PROOF STEP]
obtain x' x'' m'' where red: "t' \<turnstile> \<langle>x', shr s\<rangle> -ta\<rightarrow> \<langle>x'', m''\<rangle>"
          and tst': "thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>"
          and aoe: "actions_ok s t' ta"
          and s'': "redT_upd s t' ta x'' m'' s''"
[PROOF STATE]
proof (prove)
using this:
s -t'\<triangleright>ta\<rightarrow> s''
m\<tau>move s (t', ta) s''

goal (1 subgoal):
 1. (\<And>x' x'' m''. \<lbrakk>t' \<turnstile> \<langle>x', shr s\<rangle> -ta\<rightarrow> \<langle>x'', m''\<rangle>; thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>; actions_ok s t' ta; redT_upd s t' ta x'' m'' s''\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by cases(fastforce elim: m\<tau>move.cases)+
[PROOF STATE]
proof (state)
this:
t' \<turnstile> \<langle>x', shr s\<rangle> -ta\<rightarrow> \<langle>x'', m''\<rangle>
thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>
actions_ok s t' ta
redT_upd s t' ta x'' m'' s''

goal (1 subgoal):
 1. \<And>s ta. \<exists>sa x. thr sa t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset sa t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s = (locks sa, ((thr sa)(t := None), shr sa), wset sa, interrupts sa) \<and> ta = (x, shr sa) \<and> mthr.\<tau>diverge sa \<and> silent_moves t xm' ta \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' ta \<and> s' = s \<or> mthr.silent_movet s s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
from \<open>m\<tau>move s (t', ta) s''\<close>
[PROOF STATE]
proof (chain)
picking this:
m\<tau>move s (t', ta) s''
[PROOF STEP]
have [simp]: "ta = \<epsilon>"
[PROOF STATE]
proof (prove)
using this:
m\<tau>move s (t', ta) s''

goal (1 subgoal):
 1. ta = \<lbrace>\<rbrace>
[PROOF STEP]
by(auto elim!: m\<tau>move.cases dest!: silent_tl)
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>\<rbrace>

goal (1 subgoal):
 1. \<And>s ta. \<exists>sa x. thr sa t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset sa t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s = (locks sa, ((thr sa)(t := None), shr sa), wset sa, interrupts sa) \<and> ta = (x, shr sa) \<and> mthr.\<tau>diverge sa \<and> silent_moves t xm' ta \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' ta \<and> s' = s \<or> mthr.silent_movet s s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
hence wst': "wset s t' = None"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>\<rbrace>

goal (1 subgoal):
 1. wset s t' = None
[PROOF STEP]
using aoe
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>\<rbrace>
actions_ok s t' ta

goal (1 subgoal):
 1. wset s t' = None
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
wset s t' = None

goal (1 subgoal):
 1. \<And>s ta. \<exists>sa x. thr sa t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset sa t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s = (locks sa, ((thr sa)(t := None), shr sa), wset sa, interrupts sa) \<and> ta = (x, shr sa) \<and> mthr.\<tau>diverge sa \<and> silent_moves t xm' ta \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' ta \<and> s' = s \<or> mthr.silent_movet s s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
from \<open>m\<tau>move s (t', ta) s''\<close> tst' s''
[PROOF STATE]
proof (chain)
picking this:
m\<tau>move s (t', ta) s''
thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>
redT_upd s t' ta x'' m'' s''
[PROOF STEP]
have "\<tau>move (x', shr s) \<epsilon> (x'', m'')"
[PROOF STATE]
proof (prove)
using this:
m\<tau>move s (t', ta) s''
thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>
redT_upd s t' ta x'' m'' s''

goal (1 subgoal):
 1. \<tau>move (x', shr s) \<lbrace>\<rbrace> (x'', m'')
[PROOF STEP]
by(auto elim: m\<tau>move.cases)
[PROOF STATE]
proof (state)
this:
\<tau>move (x', shr s) \<lbrace>\<rbrace> (x'', m'')

goal (1 subgoal):
 1. \<And>s ta. \<exists>sa x. thr sa t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset sa t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s = (locks sa, ((thr sa)(t := None), shr sa), wset sa, interrupts sa) \<and> ta = (x, shr sa) \<and> mthr.\<tau>diverge sa \<and> silent_moves t xm' ta \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' ta \<and> s' = s \<or> mthr.silent_movet s s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
proof(cases "t' = t")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
t' \<noteq> t

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
with tst' wst'
[PROOF STATE]
proof (chain)
picking this:
thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s t' = None
t' \<noteq> t
[PROOF STEP]
have "thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>"
            "wset s' t' = None" "shr s' = shr s"
[PROOF STATE]
proof (prove)
using this:
thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s t' = None
t' \<noteq> t

goal (1 subgoal):
 1. thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor> &&& wset s' t' = None &&& shr s' = shr s
[PROOF STEP]
unfolding s'_def
[PROOF STATE]
proof (prove)
using this:
thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s t' = None
t' \<noteq> t

goal (1 subgoal):
 1. thr (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) t' = \<lfloor>(x', no_wait_locks)\<rfloor> &&& wset (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) t' = None &&& shr (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) = shr s
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s' t' = None
shr s' = shr s

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
with red
[PROOF STATE]
proof (chain)
picking this:
t' \<turnstile> \<langle>x', shr s\<rangle> -ta\<rightarrow> \<langle>x'', m''\<rangle>
thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s' t' = None
shr s' = shr s
[PROOF STEP]
have "s' -t'\<triangleright>\<epsilon>\<rightarrow> redT_upd_\<epsilon> s' t' x'' m''"
[PROOF STATE]
proof (prove)
using this:
t' \<turnstile> \<langle>x', shr s\<rangle> -ta\<rightarrow> \<langle>x'', m''\<rangle>
thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s' t' = None
shr s' = shr s

goal (1 subgoal):
 1. s' -t'\<triangleright>\<lbrace>\<rbrace>\<rightarrow> redT_upd_\<epsilon> s' t' x'' m''
[PROOF STEP]
by -(rule redT_normal, auto simp add: redT_updLns_def o_def finfun_Diag_const2 redT_updWs_def)
[PROOF STATE]
proof (state)
this:
s' -t'\<triangleright>\<lbrace>\<rbrace>\<rightarrow> redT_upd_\<epsilon> s' t' x'' m''

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
s' -t'\<triangleright>\<lbrace>\<rbrace>\<rightarrow> redT_upd_\<epsilon> s' t' x'' m''

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
from \<open>\<tau>move (x', shr s) \<epsilon> (x'', m'')\<close> \<open>thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>\<close> \<open>shr s' = shr s\<close>
[PROOF STATE]
proof (chain)
picking this:
\<tau>move (x', shr s) \<lbrace>\<rbrace> (x'', m'')
thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>
shr s' = shr s
[PROOF STEP]
have "m\<tau>move s' (t', ta) (redT_upd_\<epsilon> s' t' x'' m'')"
[PROOF STATE]
proof (prove)
using this:
\<tau>move (x', shr s) \<lbrace>\<rbrace> (x'', m'')
thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>
shr s' = shr s

goal (1 subgoal):
 1. m\<tau>move s' (t', ta) (redT_upd_\<epsilon> s' t' x'' m'')
[PROOF STEP]
by -(rule m\<tau>move.intros, auto)
[PROOF STATE]
proof (state)
this:
m\<tau>move s' (t', ta) (redT_upd_\<epsilon> s' t' x'' m'')

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
s' -t'\<triangleright>\<lbrace>\<rbrace>\<rightarrow> redT_upd_\<epsilon> s' t' x'' m''
m\<tau>move s' (t', ta) (redT_upd_\<epsilon> s' t' x'' m'')
[PROOF STEP]
have "\<tau>mredT s' (redT_upd_\<epsilon> s' t' x'' m'')"
[PROOF STATE]
proof (prove)
using this:
s' -t'\<triangleright>\<lbrace>\<rbrace>\<rightarrow> redT_upd_\<epsilon> s' t' x'' m''
m\<tau>move s' (t', ta) (redT_upd_\<epsilon> s' t' x'' m'')

goal (1 subgoal):
 1. \<tau>mredT s' (redT_upd_\<epsilon> s' t' x'' m'')
[PROOF STEP]
unfolding \<open>ta = \<epsilon>\<close>
[PROOF STATE]
proof (prove)
using this:
s' -t'\<triangleright>\<lbrace>\<rbrace>\<rightarrow> redT_upd_\<epsilon> s' t' x'' m''
m\<tau>move s' (t', \<lbrace>\<rbrace>) (redT_upd_\<epsilon> s' t' x'' m'')

goal (1 subgoal):
 1. \<tau>mredT s' (redT_upd_\<epsilon> s' t' x'' m'')
[PROOF STEP]
by(rule mthr.silent_move.intros)
[PROOF STATE]
proof (state)
this:
\<tau>mredT s' (redT_upd_\<epsilon> s' t' x'' m'')

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
hence "\<tau>mredT^++ s' (redT_upd_\<epsilon> s' t' x'' m'')"
[PROOF STATE]
proof (prove)
using this:
\<tau>mredT s' (redT_upd_\<epsilon> s' t' x'' m'')

goal (1 subgoal):
 1. mthr.silent_movet s' (redT_upd_\<epsilon> s' t' x'' m'')
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
mthr.silent_movet s' (redT_upd_\<epsilon> s' t' x'' m'')

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
mthr.silent_movet s' (redT_upd_\<epsilon> s' t' x'' m'')

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
have "thr s'' t = \<lfloor>(x, ln)\<rfloor>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. thr s'' t = \<lfloor>(x, ln)\<rfloor>
[PROOF STEP]
using tst \<open>t' \<noteq> t\<close> s''
[PROOF STATE]
proof (prove)
using this:
thr s t = \<lfloor>(x, ln)\<rfloor>
t' \<noteq> t
redT_upd s t' ta x'' m'' s''

goal (1 subgoal):
 1. thr s'' t = \<lfloor>(x, ln)\<rfloor>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
thr s'' t = \<lfloor>(x, ln)\<rfloor>

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
thr s'' t = \<lfloor>(x, ln)\<rfloor>

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
from \<open>\<tau>move (x', shr s) \<epsilon> (x'', m'')\<close> red
[PROOF STATE]
proof (chain)
picking this:
\<tau>move (x', shr s) \<lbrace>\<rbrace> (x'', m'')
t' \<turnstile> \<langle>x', shr s\<rangle> -ta\<rightarrow> \<langle>x'', m''\<rangle>
[PROOF STEP]
have [simp]: "m'' = shr s"
[PROOF STATE]
proof (prove)
using this:
\<tau>move (x', shr s) \<lbrace>\<rbrace> (x'', m'')
t' \<turnstile> \<langle>x', shr s\<rangle> -ta\<rightarrow> \<langle>x'', m''\<rangle>

goal (1 subgoal):
 1. m'' = shr s
[PROOF STEP]
by(auto dest: \<tau>move_heap)
[PROOF STATE]
proof (state)
this:
m'' = shr s

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
hence "shr s = shr s''"
[PROOF STATE]
proof (prove)
using this:
m'' = shr s

goal (1 subgoal):
 1. shr s = shr s''
[PROOF STEP]
using s''
[PROOF STATE]
proof (prove)
using this:
m'' = shr s
redT_upd s t' ta x'' m'' s''

goal (1 subgoal):
 1. shr s = shr s''
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
shr s = shr s''

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
have "ln \<noteq> no_wait_locks \<or> wset s'' t \<noteq> None \<or> \<not> \<tau>diverge t xm'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ln \<noteq> no_wait_locks \<or> wset s'' t \<noteq> None \<or> \<not> \<tau>diverge t xm'
[PROOF STEP]
using blocked s''
[PROOF STATE]
proof (prove)
using this:
ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm'
redT_upd s t' ta x'' m'' s''

goal (1 subgoal):
 1. ln \<noteq> no_wait_locks \<or> wset s'' t \<noteq> None \<or> \<not> \<tau>diverge t xm'
[PROOF STEP]
by(auto simp add: redT_updWs_def elim!: rtrancl3p_cases)
[PROOF STATE]
proof (state)
this:
ln \<noteq> no_wait_locks \<or> wset s'' t \<noteq> None \<or> \<not> \<tau>diverge t xm'

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ln \<noteq> no_wait_locks \<or> wset s'' t \<noteq> None \<or> \<not> \<tau>diverge t xm'

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
have "redT_upd_\<epsilon> s' t' x'' m'' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. redT_upd_\<epsilon> s' t' x'' m'' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
[PROOF STEP]
unfolding s'_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. redT_upd_\<epsilon> (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) t' x'' m'' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
[PROOF STEP]
using tst s'' \<open>t' \<noteq> t\<close>
[PROOF STATE]
proof (prove)
using this:
thr s t = \<lfloor>(x, ln)\<rfloor>
redT_upd s t' ta x'' m'' s''
t' \<noteq> t

goal (1 subgoal):
 1. redT_upd_\<epsilon> (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) t' x'' m'' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
[PROOF STEP]
by(auto intro: ext elim!: rtrancl3p_cases simp add: redT_updLns_def redT_updWs_def)
[PROOF STATE]
proof (state)
this:
redT_upd_\<epsilon> s' t' x'' m'' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')

goal (2 subgoals):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
 2. t' \<noteq> t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
mthr.silent_movet s' (redT_upd_\<epsilon> s' t' x'' m'')
thr s'' t = \<lfloor>(x, ln)\<rfloor>
ln \<noteq> no_wait_locks \<or> wset s'' t \<noteq> None \<or> \<not> \<tau>diverge t xm'
redT_upd_\<epsilon> s' t' x'' m'' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
mthr.silent_movet s' (redT_upd_\<epsilon> s' t' x'' m'')
thr s'' t = \<lfloor>(x, ln)\<rfloor>
ln \<noteq> no_wait_locks \<or> wset s'' t \<noteq> None \<or> \<not> \<tau>diverge t xm'
redT_upd_\<epsilon> s' t' x'' m'' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')

goal (1 subgoal):
 1. \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
using \<open>mthr.\<tau>diverge s''\<close> xmxm'
[PROOF STATE]
proof (prove)
using this:
mthr.silent_movet s' (redT_upd_\<epsilon> s' t' x'' m'')
thr s'' t = \<lfloor>(x, ln)\<rfloor>
ln \<noteq> no_wait_locks \<or> wset s'' t \<noteq> None \<or> \<not> \<tau>diverge t xm'
redT_upd_\<epsilon> s' t' x'' m'' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
mthr.\<tau>diverge s''
silent_moves t xm' (x, shr s)

goal (1 subgoal):
 1. \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
unfolding \<open>shr s = shr s''\<close>
[PROOF STATE]
proof (prove)
using this:
mthr.silent_movet s' (redT_upd_\<epsilon> s' t' x'' m'')
thr s'' t = \<lfloor>(x, ln)\<rfloor>
ln \<noteq> no_wait_locks \<or> wset s'' t \<noteq> None \<or> \<not> \<tau>diverge t xm'
redT_upd_\<epsilon> s' t' x'' m'' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
mthr.\<tau>diverge s''
silent_moves t xm' (x, shr s'')

goal (1 subgoal):
 1. \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
t' = t

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
with tst tst' wst' blocked
[PROOF STATE]
proof (chain)
picking this:
thr s t = \<lfloor>(x, ln)\<rfloor>
thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s t' = None
ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm'
t' = t
[PROOF STEP]
have "\<not> \<tau>diverge t xm'"
            and [simp]: "x' = x"
[PROOF STATE]
proof (prove)
using this:
thr s t = \<lfloor>(x, ln)\<rfloor>
thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s t' = None
ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm'
t' = t

goal (1 subgoal):
 1. \<not> \<tau>diverge t xm' &&& x' = x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> \<tau>diverge t xm'
x' = x

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<not> \<tau>diverge t xm'
x' = x

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
from red \<open>\<tau>move (x', shr s) \<epsilon> (x'', m'')\<close> True
[PROOF STATE]
proof (chain)
picking this:
t' \<turnstile> \<langle>x', shr s\<rangle> -ta\<rightarrow> \<langle>x'', m''\<rangle>
\<tau>move (x', shr s) \<lbrace>\<rbrace> (x'', m'')
t' = t
[PROOF STEP]
have "silent_move t (x, shr s) (x'', m'')"
[PROOF STATE]
proof (prove)
using this:
t' \<turnstile> \<langle>x', shr s\<rangle> -ta\<rightarrow> \<langle>x'', m''\<rangle>
\<tau>move (x', shr s) \<lbrace>\<rbrace> (x'', m'')
t' = t

goal (1 subgoal):
 1. silent_move t (x, shr s) (x'', m'')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
silent_move t (x, shr s) (x'', m'')

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
with xmxm'
[PROOF STATE]
proof (chain)
picking this:
silent_moves t xm' (x, shr s)
silent_move t (x, shr s) (x'', m'')
[PROOF STEP]
have "silent_move_from t xm' (x, shr s) (x'', m'')"
[PROOF STATE]
proof (prove)
using this:
silent_moves t xm' (x, shr s)
silent_move t (x, shr s) (x'', m'')

goal (1 subgoal):
 1. silent_move_from t xm' (x, shr s) (x'', m'')
[PROOF STEP]
by(rule silent_move_fromI)
[PROOF STATE]
proof (state)
this:
silent_move_from t xm' (x, shr s) (x'', m'')

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<not> \<tau>diverge t xm'
x' = x
silent_move_from t xm' (x, shr s) (x'', m'')
[PROOF STEP]
have "(if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) (x'', m'') xm"
[PROOF STATE]
proof (prove)
using this:
\<not> \<tau>diverge t xm'
x' = x
silent_move_from t xm' (x, shr s) (x'', m'')

goal (1 subgoal):
 1. (if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) (x'', m'') xm
[PROOF STEP]
by(auto simp add: flip_conv xm_def)
[PROOF STATE]
proof (state)
this:
(if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) (x'', m'') xm

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) (x'', m'') xm

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
have "thr s'' t = \<lfloor>(x'', ln)\<rfloor>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. thr s'' t = \<lfloor>(x'', ln)\<rfloor>
[PROOF STEP]
using tst True s''
[PROOF STATE]
proof (prove)
using this:
thr s t = \<lfloor>(x, ln)\<rfloor>
t' = t
redT_upd s t' ta x'' m'' s''

goal (1 subgoal):
 1. thr s'' t = \<lfloor>(x'', ln)\<rfloor>
[PROOF STEP]
by(auto simp add: redT_updLns_def)
[PROOF STATE]
proof (state)
this:
thr s'' t = \<lfloor>(x'', ln)\<rfloor>

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
thr s'' t = \<lfloor>(x'', ln)\<rfloor>

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
from \<open>\<tau>move (x', shr s) \<epsilon> (x'', m'')\<close> red
[PROOF STATE]
proof (chain)
picking this:
\<tau>move (x', shr s) \<lbrace>\<rbrace> (x'', m'')
t' \<turnstile> \<langle>x', shr s\<rangle> -ta\<rightarrow> \<langle>x'', m''\<rangle>
[PROOF STEP]
have [simp]: "m'' = shr s"
[PROOF STATE]
proof (prove)
using this:
\<tau>move (x', shr s) \<lbrace>\<rbrace> (x'', m'')
t' \<turnstile> \<langle>x', shr s\<rangle> -ta\<rightarrow> \<langle>x'', m''\<rangle>

goal (1 subgoal):
 1. m'' = shr s
[PROOF STEP]
by(auto dest: \<tau>move_heap)
[PROOF STATE]
proof (state)
this:
m'' = shr s

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
hence "shr s = shr s''"
[PROOF STATE]
proof (prove)
using this:
m'' = shr s

goal (1 subgoal):
 1. shr s = shr s''
[PROOF STEP]
using s''
[PROOF STATE]
proof (prove)
using this:
m'' = shr s
redT_upd s t' ta x'' m'' s''

goal (1 subgoal):
 1. shr s = shr s''
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
shr s = shr s''

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
have "s' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
[PROOF STEP]
using True s''
[PROOF STATE]
proof (prove)
using this:
t' = t
redT_upd s t' ta x'' m'' s''

goal (1 subgoal):
 1. s' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
[PROOF STEP]
unfolding s'_def
[PROOF STATE]
proof (prove)
using this:
t' = t
redT_upd s t' ta x'' m'' s''

goal (1 subgoal):
 1. (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
[PROOF STEP]
by(auto intro: ext elim!: rtrancl3p_cases simp add: redT_updLns_def redT_updWs_def)
[PROOF STATE]
proof (state)
this:
s' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
s' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
have "(x'', m'') = (x'', shr s'')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x'', m'') = (x'', shr s'')
[PROOF STEP]
using s''
[PROOF STATE]
proof (prove)
using this:
redT_upd s t' ta x'' m'' s''

goal (1 subgoal):
 1. (x'', m'') = (x'', shr s'')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(x'', m'') = (x'', shr s'')

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(x'', m'') = (x'', shr s'')

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
from xmxm' \<open>silent_move t (x, shr s) (x'', m'')\<close>
[PROOF STATE]
proof (chain)
picking this:
silent_moves t xm' (x, shr s)
silent_move t (x, shr s) (x'', m'')
[PROOF STEP]
have "silent_moves t xm' (x'', shr s'')"
[PROOF STATE]
proof (prove)
using this:
silent_moves t xm' (x, shr s)
silent_move t (x, shr s) (x'', m'')

goal (1 subgoal):
 1. silent_moves t xm' (x'', shr s'')
[PROOF STEP]
unfolding \<open>m'' = shr s\<close> \<open>shr s = shr s''\<close>
[PROOF STATE]
proof (prove)
using this:
silent_moves t xm' (x, shr s'')
silent_move t (x, shr s'') (x'', shr s'')

goal (1 subgoal):
 1. silent_moves t xm' (x'', shr s'')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
silent_moves t xm' (x'', shr s'')

goal (1 subgoal):
 1. t' = t \<Longrightarrow> \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) (x'', m'') xm
thr s'' t = \<lfloor>(x'', ln)\<rfloor>
s' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
(x'', m'') = (x'', shr s'')
silent_moves t xm' (x'', shr s'')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) (x'', m'') xm
thr s'' t = \<lfloor>(x'', ln)\<rfloor>
s' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
(x'', m'') = (x'', shr s'')
silent_moves t xm' (x'', shr s'')

goal (1 subgoal):
 1. \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
using \<open>\<not> \<tau>diverge t xm'\<close> \<open>mthr.\<tau>diverge s''\<close>
[PROOF STATE]
proof (prove)
using this:
(if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) (x'', m'') xm
thr s'' t = \<lfloor>(x'', ln)\<rfloor>
s' = (locks s'', ((thr s'')(t := None), shr s''), wset s'', interrupts s'')
(x'', m'') = (x'', shr s'')
silent_moves t xm' (x'', shr s'')
\<not> \<tau>diverge t xm'
mthr.\<tau>diverge s''

goal (1 subgoal):
 1. \<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>s' t'. ((if \<tau>diverge t xm' then \<lambda>s s'. False else flip (silent_move_from t xm')) t' xm \<and> s' = s' \<or> mthr.silent_movet s' s') \<and> ((\<exists>s x. thr s t = \<lfloor>(x, ln)\<rfloor> \<and> (ln \<noteq> no_wait_locks \<or> wset s t \<noteq> None \<or> \<not> \<tau>diverge t xm') \<and> s' = (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) \<and> t' = (x, shr s) \<and> mthr.\<tau>diverge s \<and> silent_moves t xm' t') \<or> mthr.\<tau>diverge s')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
mthr.\<tau>diverge s'

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
mthr.\<tau>diverge s'

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
A = dom (thr s')
mthr.\<tau>diverge s'
[PROOF STEP]
have "\<exists>t x. thr s' t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s' t = None \<and> \<tau>diverge t (x, shr s')"
[PROOF STATE]
proof (prove)
using this:
A = dom (thr s')
mthr.\<tau>diverge s'

goal (1 subgoal):
 1. \<exists>t x. thr s' t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s' t = None \<and> \<tau>diverge t (x, shr s')
[PROOF STEP]
by(rule IH)
[PROOF STATE]
proof (state)
this:
\<exists>t x. thr s' t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s' t = None \<and> \<tau>diverge t (x, shr s')

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>t x. thr s' t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s' t = None \<and> \<tau>diverge t (x, shr s')
[PROOF STEP]
obtain t' x' where "thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>"
      and "wset s' t' = None" and "\<tau>diverge t' (x', shr s')"
[PROOF STATE]
proof (prove)
using this:
\<exists>t x. thr s' t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s' t = None \<and> \<tau>diverge t (x, shr s')

goal (1 subgoal):
 1. (\<And>t' x'. \<lbrakk>thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>; wset s' t' = None; \<tau>diverge t' (x', shr s')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s' t' = None
\<tau>diverge t' (x', shr s')

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s' t' = None
\<tau>diverge t' (x', shr s')

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
with False
[PROOF STATE]
proof (chain)
picking this:
\<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None)
thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s' t' = None
\<tau>diverge t' (x', shr s')
[PROOF STEP]
have "t' \<noteq> t"
[PROOF STATE]
proof (prove)
using this:
\<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None)
thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s' t' = None
\<tau>diverge t' (x', shr s')

goal (1 subgoal):
 1. t' \<noteq> t
[PROOF STEP]
by(auto simp add: s'_def)
[PROOF STATE]
proof (state)
this:
t' \<noteq> t

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s' t' = None
\<tau>diverge t' (x', shr s')
t' \<noteq> t
[PROOF STEP]
have "thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>" "wset s t' = None" "\<tau>diverge t' (x', shr s)"
[PROOF STATE]
proof (prove)
using this:
thr s' t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s' t' = None
\<tau>diverge t' (x', shr s')
t' \<noteq> t

goal (1 subgoal):
 1. thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor> &&& wset s t' = None &&& \<tau>diverge t' (x', shr s)
[PROOF STEP]
unfolding s'_def
[PROOF STATE]
proof (prove)
using this:
thr (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset (locks s, ((thr s)(t := None), shr s), wset s, interrupts s) t' = None
\<tau>diverge t' (x', shr (locks s, ((thr s)(t := None), shr s), wset s, interrupts s))
t' \<noteq> t

goal (1 subgoal):
 1. thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor> &&& wset s t' = None &&& \<tau>diverge t' (x', shr s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s t' = None
\<tau>diverge t' (x', shr s)

goal (1 subgoal):
 1. \<not> (ln = no_wait_locks \<and> \<tau>diverge t (x, shr s) \<and> wset s t = None) \<Longrightarrow> \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
thr s t' = \<lfloor>(x', no_wait_locks)\<rfloor>
wset s t' = None
\<tau>diverge t' (x', shr s)

goal (1 subgoal):
 1. \<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>t x. thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> wset s t = None \<and> \<tau>diverge t (x, shr s)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "P \<and> Q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<and> Q
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<and> Q
[PROOF STEP]
oops