[STATEMENT]
lemma WT_gpv_parametric': includes lifting_syntax shows
  "bi_unique C \<Longrightarrow> (rel_\<I> C R ===> rel_gpv'' A C R ===> (=)) WT_gpv WT_gpv"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bi_unique C \<Longrightarrow> (rel_\<I> C R ===> rel_gpv'' A C R ===> (=)) WT_gpv WT_gpv
[PROOF STEP]
proof(rule rel_funI iffI)+
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x y xa ya. \<lbrakk>bi_unique C; rel_\<I> C R x y; rel_gpv'' A C R xa ya; x \<turnstile>g xa \<surd>\<rbrakk> \<Longrightarrow> y \<turnstile>g ya \<surd>
 2. \<And>x y xa ya. \<lbrakk>bi_unique C; rel_\<I> C R x y; rel_gpv'' A C R xa ya; y \<turnstile>g ya \<surd>\<rbrakk> \<Longrightarrow> x \<turnstile>g xa \<surd>
[PROOF STEP]
note [transfer_rule] = the_gpv_parametric'
[PROOF STATE]
proof (state)
this:
(rel_gpv'' ?A ?C ?R ===> rel_spmf (rel_generat ?A ?C (?R ===> rel_gpv'' ?A ?C ?R))) the_gpv the_gpv

goal (2 subgoals):
 1. \<And>x y xa ya. \<lbrakk>bi_unique C; rel_\<I> C R x y; rel_gpv'' A C R xa ya; x \<turnstile>g xa \<surd>\<rbrakk> \<Longrightarrow> y \<turnstile>g ya \<surd>
 2. \<And>x y xa ya. \<lbrakk>bi_unique C; rel_\<I> C R x y; rel_gpv'' A C R xa ya; y \<turnstile>g ya \<surd>\<rbrakk> \<Longrightarrow> x \<turnstile>g xa \<surd>
[PROOF STEP]
show *: "\<I> \<turnstile>g gpv \<surd>" if [transfer_rule]: "rel_\<I> C R \<I> \<I>'" "bi_unique C"
    and *: "\<I>' \<turnstile>g gpv' \<surd>" "rel_gpv'' A C R gpv gpv'" for \<I> \<I>' gpv gpv' A C R
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<I> \<turnstile>g gpv \<surd>
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
\<I>' \<turnstile>g gpv' \<surd>
rel_gpv'' A C R gpv gpv'

goal (1 subgoal):
 1. \<I> \<turnstile>g gpv \<surd>
[PROOF STEP]
proof(coinduction arbitrary: gpv gpv')
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>out c gpva__ gpv'. \<lbrakk>\<I>' \<turnstile>g gpv' \<surd>; rel_gpv'' A C R gpva__ gpv'; IO out c \<in> set_spmf (the_gpv gpva__)\<rbrakk> \<Longrightarrow> out \<in> outs_\<I> \<I> \<and> (\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>)
[PROOF STEP]
case (WT_gpv out c gpv gpv')
[PROOF STATE]
proof (state)
this:
\<I>' \<turnstile>g gpv' \<surd>
rel_gpv'' A C R gpv gpv'
IO out c \<in> set_spmf (the_gpv gpv)

goal (1 subgoal):
 1. \<And>out c gpva__ gpv'. \<lbrakk>\<I>' \<turnstile>g gpv' \<surd>; rel_gpv'' A C R gpva__ gpv'; IO out c \<in> set_spmf (the_gpv gpva__)\<rbrakk> \<Longrightarrow> out \<in> outs_\<I> \<I> \<and> (\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>)
[PROOF STEP]
note [transfer_rule] = WT_gpv(2)
[PROOF STATE]
proof (state)
this:
rel_gpv'' A C R gpv gpv'

goal (1 subgoal):
 1. \<And>out c gpva__ gpv'. \<lbrakk>\<I>' \<turnstile>g gpv' \<surd>; rel_gpv'' A C R gpva__ gpv'; IO out c \<in> set_spmf (the_gpv gpva__)\<rbrakk> \<Longrightarrow> out \<in> outs_\<I> \<I> \<and> (\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>)
[PROOF STEP]
have "rel_set (rel_generat A C (R ===> rel_gpv'' A C R)) (set_spmf (the_gpv gpv)) (set_spmf (the_gpv gpv'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_set (rel_generat A C (R ===> rel_gpv'' A C R)) (set_spmf (the_gpv gpv)) (set_spmf (the_gpv gpv'))
[PROOF STEP]
by transfer_prover
[PROOF STATE]
proof (state)
this:
rel_set (rel_generat A C (R ===> rel_gpv'' A C R)) (set_spmf (the_gpv gpv)) (set_spmf (the_gpv gpv'))

goal (1 subgoal):
 1. \<And>out c gpva__ gpv'. \<lbrakk>\<I>' \<turnstile>g gpv' \<surd>; rel_gpv'' A C R gpva__ gpv'; IO out c \<in> set_spmf (the_gpv gpva__)\<rbrakk> \<Longrightarrow> out \<in> outs_\<I> \<I> \<and> (\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>)
[PROOF STEP]
from rel_setD1[OF this WT_gpv(3)]
[PROOF STATE]
proof (chain)
picking this:
\<exists>y\<in>set_spmf (the_gpv gpv'). rel_generat A C (R ===> rel_gpv'' A C R) (IO out c) y
[PROOF STEP]
obtain out' c'
      where [transfer_rule]: "C out out'" "(R ===> rel_gpv'' A C R) c c'"
        and out': "IO out' c' \<in> set_spmf (the_gpv gpv')"
[PROOF STATE]
proof (prove)
using this:
\<exists>y\<in>set_spmf (the_gpv gpv'). rel_generat A C (R ===> rel_gpv'' A C R) (IO out c) y

goal (1 subgoal):
 1. (\<And>out' c'. \<lbrakk>C out out'; (R ===> rel_gpv'' A C R) c c'; IO out' c' \<in> set_spmf (the_gpv gpv')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(auto elim: generat.rel_cases)
[PROOF STATE]
proof (state)
this:
C out out'
(R ===> rel_gpv'' A C R) c c'
IO out' c' \<in> set_spmf (the_gpv gpv')

goal (1 subgoal):
 1. \<And>out c gpva__ gpv'. \<lbrakk>\<I>' \<turnstile>g gpv' \<surd>; rel_gpv'' A C R gpva__ gpv'; IO out c \<in> set_spmf (the_gpv gpva__)\<rbrakk> \<Longrightarrow> out \<in> outs_\<I> \<I> \<and> (\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>)
[PROOF STEP]
have "out \<in> outs_\<I> \<I> \<longleftrightarrow> out' \<in> outs_\<I> \<I>'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (out \<in> outs_\<I> \<I>) = (out' \<in> outs_\<I> \<I>')
[PROOF STEP]
by transfer_prover
[PROOF STATE]
proof (state)
this:
(out \<in> outs_\<I> \<I>) = (out' \<in> outs_\<I> \<I>')

goal (1 subgoal):
 1. \<And>out c gpva__ gpv'. \<lbrakk>\<I>' \<turnstile>g gpv' \<surd>; rel_gpv'' A C R gpva__ gpv'; IO out c \<in> set_spmf (the_gpv gpva__)\<rbrakk> \<Longrightarrow> out \<in> outs_\<I> \<I> \<and> (\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>)
[PROOF STEP]
with WT_gpvD(1)[OF WT_gpv(1) out']
[PROOF STATE]
proof (chain)
picking this:
out' \<in> outs_\<I> \<I>'
(out \<in> outs_\<I> \<I>) = (out' \<in> outs_\<I> \<I>')
[PROOF STEP]
have ?out
[PROOF STATE]
proof (prove)
using this:
out' \<in> outs_\<I> \<I>'
(out \<in> outs_\<I> \<I>) = (out' \<in> outs_\<I> \<I>')

goal (1 subgoal):
 1. out \<in> outs_\<I> \<I>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
out \<in> outs_\<I> \<I>

goal (1 subgoal):
 1. \<And>out c gpva__ gpv'. \<lbrakk>\<I>' \<turnstile>g gpv' \<surd>; rel_gpv'' A C R gpva__ gpv'; IO out c \<in> set_spmf (the_gpv gpva__)\<rbrakk> \<Longrightarrow> out \<in> outs_\<I> \<I> \<and> (\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
out \<in> outs_\<I> \<I>

goal (1 subgoal):
 1. \<And>out c gpva__ gpv'. \<lbrakk>\<I>' \<turnstile>g gpv' \<surd>; rel_gpv'' A C R gpva__ gpv'; IO out c \<in> set_spmf (the_gpv gpva__)\<rbrakk> \<Longrightarrow> out \<in> outs_\<I> \<I> \<and> (\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>)
[PROOF STEP]
have ?cont
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>
[PROOF STEP]
proof(standard; goal_cases cont)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>input. input \<in> responses_\<I> \<I> out \<Longrightarrow> (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>
[PROOF STEP]
case (cont input)
[PROOF STATE]
proof (state)
this:
input \<in> responses_\<I> \<I> out

goal (1 subgoal):
 1. \<And>input. input \<in> responses_\<I> \<I> out \<Longrightarrow> (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>
[PROOF STEP]
have "rel_set R (responses_\<I> \<I> out) (responses_\<I> \<I>' out')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_set R (responses_\<I> \<I> out) (responses_\<I> \<I>' out')
[PROOF STEP]
by transfer_prover
[PROOF STATE]
proof (state)
this:
rel_set R (responses_\<I> \<I> out) (responses_\<I> \<I>' out')

goal (1 subgoal):
 1. \<And>input. input \<in> responses_\<I> \<I> out \<Longrightarrow> (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>
[PROOF STEP]
from rel_setD1[OF this cont]
[PROOF STATE]
proof (chain)
picking this:
\<exists>y\<in>responses_\<I> \<I>' out'. R input y
[PROOF STEP]
obtain input' where [transfer_rule]: "R input input'"
        and input': "input' \<in> responses_\<I> \<I>' out'"
[PROOF STATE]
proof (prove)
using this:
\<exists>y\<in>responses_\<I> \<I>' out'. R input y

goal (1 subgoal):
 1. (\<And>input'. \<lbrakk>R input input'; input' \<in> responses_\<I> \<I>' out'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
R input input'
input' \<in> responses_\<I> \<I>' out'

goal (1 subgoal):
 1. \<And>input. input \<in> responses_\<I> \<I> out \<Longrightarrow> (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>
[PROOF STEP]
have "rel_gpv'' A C R (c input) (c' input')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_gpv'' A C R (c input) (c' input')
[PROOF STEP]
by transfer_prover
[PROOF STATE]
proof (state)
this:
rel_gpv'' A C R (c input) (c' input')

goal (1 subgoal):
 1. \<And>input. input \<in> responses_\<I> \<I> out \<Longrightarrow> (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>
[PROOF STEP]
with WT_gpvD(2)[OF WT_gpv(1) out' input']
[PROOF STATE]
proof (chain)
picking this:
\<I>' \<turnstile>g c' input' \<surd>
rel_gpv'' A C R (c input) (c' input')
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<I>' \<turnstile>g c' input' \<surd>
rel_gpv'' A C R (c input) (c' input')

goal (1 subgoal):
 1. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>

goal (1 subgoal):
 1. \<And>out c gpva__ gpv'. \<lbrakk>\<I>' \<turnstile>g gpv' \<surd>; rel_gpv'' A C R gpva__ gpv'; IO out c \<in> set_spmf (the_gpv gpva__)\<rbrakk> \<Longrightarrow> out \<in> outs_\<I> \<I> \<and> (\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
out \<in> outs_\<I> \<I>
\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
out \<in> outs_\<I> \<I>
\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>

goal (1 subgoal):
 1. out \<in> outs_\<I> \<I> \<and> (\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
out \<in> outs_\<I> \<I> \<and> (\<forall>input\<in>responses_\<I> \<I> out. (\<exists>gpv__ gpv'. c input = gpv__ \<and> \<I>' \<turnstile>g gpv' \<surd> \<and> rel_gpv'' A C R gpv__ gpv') \<or> \<I> \<turnstile>g c input \<surd>)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>rel_\<I> ?C1 ?R1 ?\<I>1 ?\<I>'1; bi_unique ?C1; ?\<I>'1 \<turnstile>g ?gpv'1 \<surd>; rel_gpv'' ?A1 ?C1 ?R1 ?gpv1 ?gpv'1\<rbrakk> \<Longrightarrow> ?\<I>1 \<turnstile>g ?gpv1 \<surd>

goal (1 subgoal):
 1. \<And>x y xa ya. \<lbrakk>bi_unique C; rel_\<I> C R x y; rel_gpv'' A C R xa ya; x \<turnstile>g xa \<surd>\<rbrakk> \<Longrightarrow> y \<turnstile>g ya \<surd>
[PROOF STEP]
show "\<I>' \<turnstile>g gpv' \<surd>" if "rel_\<I> C R \<I> \<I>'" "bi_unique C" "\<I> \<turnstile>g gpv \<surd>" "rel_gpv'' A C R gpv gpv'"
    for \<I> \<I>' gpv gpv'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<I>' \<turnstile>g gpv' \<surd>
[PROOF STEP]
using *[of "conversep C" "conversep R" \<I>' \<I> gpv "conversep A" gpv'] that
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>rel_\<I> C\<inverse>\<inverse> R\<inverse>\<inverse> \<I>' \<I>; bi_unique C\<inverse>\<inverse>; \<I> \<turnstile>g gpv \<surd>; rel_gpv'' A\<inverse>\<inverse> C\<inverse>\<inverse> R\<inverse>\<inverse> gpv' gpv\<rbrakk> \<Longrightarrow> \<I>' \<turnstile>g gpv' \<surd>
rel_\<I> C R \<I> \<I>'
bi_unique C
\<I> \<turnstile>g gpv \<surd>
rel_gpv'' A C R gpv gpv'

goal (1 subgoal):
 1. \<I>' \<turnstile>g gpv' \<surd>
[PROOF STEP]
by(simp add: rel_gpv''_conversep)
[PROOF STATE]
proof (state)
this:
\<lbrakk>rel_\<I> C R ?\<I>1 ?\<I>'1; bi_unique C; ?\<I>1 \<turnstile>g ?gpv1 \<surd>; rel_gpv'' A C R ?gpv1 ?gpv'1\<rbrakk> \<Longrightarrow> ?\<I>'1 \<turnstile>g ?gpv'1 \<surd>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "x \<in> {x. P x}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> {x. P x}
[PROOF STEP]
refute
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> {x. P x}
[PROOF STEP]
oops


[STATEMENT]
lemma i_Exec_Comp_Stream_Acc_Output__eq_Msg_State_Idle_conv2: "
  \<lbrakk> Suc 0 < k;
    State_Idle localState output_fun trans_fun (
      i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t);
    m \<noteq> \<NoMsg>;
    t0 = t * k;
    s = i_Exec_Comp_Stream trans_fun (input \<odot>\<^sub>i k) c \<rbrakk> \<Longrightarrow>
  (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) =
  (\<diamond> t1 [0\<dots>, k - Suc 0] \<oplus> t0. (
    output_fun (s t1) = m \<and>
    (State_Idle localState output_fun trans_fun (localState (s t1)) \<or>
    (\<circle> t2 t1 [0\<dots>].
      ((output_fun (s t3) = \<NoMsg>. t3 \<U> t4 ([0\<dots>] \<oplus> t2).
       (output_fun (s t4) = \<NoMsg> \<and> State_Idle localState output_fun trans_fun (localState (s t4)))))))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> (State_Idle localState output_fun trans_fun (localState (s t1)) \<or> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4)))))
[PROOF STEP]
apply (subst conj_disj_distribL)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
[PROOF STEP]
apply (case_tac "
  \<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0.
    (State_Idle localState output_fun trans_fun (localState (s t1)) \<and> output_fun (s t1) \<noteq> \<NoMsg>)")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. State_Idle localState output_fun trans_fun (localState (s t1)) \<and> output_fun (s t1) \<noteq> NoMsg\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
 2. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<not> (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. State_Idle localState output_fun trans_fun (localState (s t1)) \<and> output_fun (s t1) \<noteq> NoMsg)\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
[PROOF STEP]
apply (elim iexE conjE, rename_tac t1)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>t1. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; State_Idle localState output_fun trans_fun (localState (s t1)); output_fun (s t1) \<noteq> NoMsg\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
 2. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<not> (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. State_Idle localState output_fun trans_fun (localState (s t1)) \<and> output_fun (s t1) \<noteq> NoMsg)\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
[PROOF STEP]
apply (rule iffI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t1. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; State_Idle localState output_fun trans_fun (localState (s t1)); output_fun (s t1) \<noteq> NoMsg; i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m\<rbrakk> \<Longrightarrow> \<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4)))
 2. \<And>t1. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; State_Idle localState output_fun trans_fun (localState (s t1)); output_fun (s t1) \<noteq> NoMsg; \<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4)))\<rbrakk> \<Longrightarrow> i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m
 3. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<not> (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. State_Idle localState output_fun trans_fun (localState (s t1)) \<and> output_fun (s t1) \<noteq> NoMsg)\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
[PROOF STEP]
apply (frule i_Exec_Comp_Stream_Acc_Output__eq_Msg_with_State_Idle_conv2[THEN iffD1, OF Suc_lessD], assumption+)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t1. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; State_Idle localState output_fun trans_fun (localState (s t1)); output_fun (s t1) \<noteq> NoMsg; i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m; \<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1))\<rbrakk> \<Longrightarrow> \<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4)))
 2. \<And>t1. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; State_Idle localState output_fun trans_fun (localState (s t1)); output_fun (s t1) \<noteq> NoMsg; \<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4)))\<rbrakk> \<Longrightarrow> i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m
 3. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<not> (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. State_Idle localState output_fun trans_fun (localState (s t1)) \<and> output_fun (s t1) \<noteq> NoMsg)\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>t1. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; State_Idle localState output_fun trans_fun (localState (s t1)); output_fun (s t1) \<noteq> NoMsg; \<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4)))\<rbrakk> \<Longrightarrow> i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m
 2. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<not> (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. State_Idle localState output_fun trans_fun (localState (s t1)) \<and> output_fun (s t1) \<noteq> NoMsg)\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
[PROOF STEP]
apply (elim iexE conjI, rename_tac t2)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>t1 t2. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; State_Idle localState output_fun trans_fun (localState (s t1)); output_fun (s t1) \<noteq> NoMsg; t2 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; output_fun (s t2) = m \<and> State_Idle localState output_fun trans_fun (localState (s t2)) \<or> output_fun (s t2) = m \<and> (\<circle> t2 t2 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4)))\<rbrakk> \<Longrightarrow> i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m
 2. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<not> (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. State_Idle localState output_fun trans_fun (localState (s t1)) \<and> output_fun (s t1) \<noteq> NoMsg)\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
[PROOF STEP]
apply (erule disjE)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t1 t2. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; State_Idle localState output_fun trans_fun (localState (s t1)); output_fun (s t1) \<noteq> NoMsg; t2 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; output_fun (s t2) = m \<and> State_Idle localState output_fun trans_fun (localState (s t2))\<rbrakk> \<Longrightarrow> i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m
 2. \<And>t1 t2. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; State_Idle localState output_fun trans_fun (localState (s t1)); output_fun (s t1) \<noteq> NoMsg; t2 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; output_fun (s t2) = m \<and> (\<circle> t2 t2 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4)))\<rbrakk> \<Longrightarrow> i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m
 3. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<not> (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. State_Idle localState output_fun trans_fun (localState (s t1)) \<and> output_fun (s t1) \<noteq> NoMsg)\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
[PROOF STEP]
apply (rule i_Exec_Comp_Stream_Acc_Output__eq_Msg_with_State_Idle_conv2[THEN iffD2], simp+)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t1 t2. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t * k; State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1)); output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1) \<noteq> NoMsg; t2 \<in> [0\<dots>,k - Suc 0] \<oplus> t * k; output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t2) = m \<and> State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t2))\<rbrakk> \<Longrightarrow> \<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t * k. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1) = m \<and> State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1))
 2. \<And>t1 t2. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; State_Idle localState output_fun trans_fun (localState (s t1)); output_fun (s t1) \<noteq> NoMsg; t2 \<in> [0\<dots>,k - Suc 0] \<oplus> t0; output_fun (s t2) = m \<and> (\<circle> t2 t2 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4)))\<rbrakk> \<Longrightarrow> i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m
 3. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<not> (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. State_Idle localState output_fun trans_fun (localState (s t1)) \<and> output_fun (s t1) \<noteq> NoMsg)\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
[PROOF STEP]
apply (rule_tac t=t2 in iexI, simp+)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>t1 t2. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; t1 \<in> [0\<dots>,k - Suc 0] \<oplus> t * k; State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1)); output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1) \<noteq> NoMsg; t2 \<in> [0\<dots>,k - Suc 0] \<oplus> t * k; output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t2) = m \<and> (\<circle> t2 t2 [0\<dots>]. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t4)))\<rbrakk> \<Longrightarrow> i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m
 2. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<not> (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. State_Idle localState output_fun trans_fun (localState (s t1)) \<and> output_fun (s t1) \<noteq> NoMsg)\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t0. output_fun (s t1) = m \<and> State_Idle localState output_fun trans_fun (localState (s t1)) \<or> output_fun (s t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (s t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (s t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (s t4))))
[PROOF STEP]
apply (rule_tac ?t1.0=t2 in i_Exec_Comp_Stream_Acc_Output__eq_Msg_before_State_Idle_imp2, simp+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<box> t1 [0\<dots>,k - Suc 0] \<oplus> t * k. State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1)) \<longrightarrow> output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1) = NoMsg\<rbrakk> \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c t = m) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t * k. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1) = m \<and> State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1)) \<or> output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t4))))
[PROOF STEP]
apply (rule ssubst[OF i_Exec_Comp_Stream_Acc_Output__eq_Msg_before_State_Idle_conv2[OF _ _ _ refl refl]], simp+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Suc 0 < k; State_Idle localState output_fun trans_fun (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c t); m \<noteq> NoMsg; t0 = t * k; s = i_Exec_Comp_Stream trans_fun (input \<odot> k) c; \<box> t1 [0\<dots>,k - Suc 0] \<oplus> t * k. State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1)) \<longrightarrow> output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1) = NoMsg\<rbrakk> \<Longrightarrow> (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t * k. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t4)))) = (\<diamond> t1 [0\<dots>,k - Suc 0] \<oplus> t * k. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1) = m \<and> State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1)) \<or> output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t1) = m \<and> (\<circle> t2 t1 [0\<dots>]. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t3) = NoMsg. t3 \<U> t4 [0\<dots>] \<oplus> t2. output_fun (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t4) = NoMsg \<and> State_Idle localState output_fun trans_fun (localState (i_Exec_Comp_Stream trans_fun (input \<odot> k) c t4))))
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "XCoP \<eta> \<Longrightarrow> iDM4 \<eta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. XCoP \<eta> \<Longrightarrow> iDM4 \<eta>
[PROOF STEP]
nitpick
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. XCoP \<eta> \<Longrightarrow> iDM4 \<eta>
[PROOF STEP]
oops


[STATEMENT]
lemma "\<sim>TND \<^bold>\<not>\<^sup>I \<and> CoP3 \<^bold>\<not>\<^sup>I"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<sim>TND \<^bold>\<not>\<^sup>I \<and> CoP3 \<^bold>\<not>\<^sup>I
[PROOF STEP]
(*nitpick[satisfy]*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<sim>TND \<^bold>\<not>\<^sup>I \<and> CoP3 \<^bold>\<not>\<^sup>I
[PROOF STEP]
oops


[STATEMENT]
lemma cond_action_ok_Join:
  "\<And>ln. \<lbrakk> cond_action_ok s t (Join T); thr s T = \<lfloor>(x, ln)\<rfloor> \<rbrakk> \<Longrightarrow> final x \<and> ln = no_wait_locks \<and> wset s T = None"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ln. \<lbrakk>cond_action_ok s t (Join T); thr s T = \<lfloor>(x, ln)\<rfloor>\<rbrakk> \<Longrightarrow> final x \<and> ln = no_wait_locks \<and> wset s T = None
[PROOF STEP]
by(auto)


[STATEMENT]
lemma [transfer_rule]:
  \<open>((=) ===> pcr_word) of_bool of_bool\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((=) ===> pcr_word) of_bool of_bool
[PROOF STEP]
by transfer_prover


[STATEMENT]
lemma CACH_GOTO:
 "\<lbrakk> ins_is C m l (goto pc); MST\<down>(C,m)=Some(Mspec,Minv,Anno);
    Anno\<down>(l) = None; derivAssum G C m pc (Cachera n) \<rbrakk>
 \<Longrightarrow> deriv G C m l (Cachera n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ins_is C m l (goto pc); MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; derivAssum G C m pc (Cachera n)\<rbrakk> \<Longrightarrow> deriv G C m l (Cachera n)
[PROOF STEP]
(*<*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ins_is C m l (goto pc); MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; derivAssum G C m pc (Cachera n)\<rbrakk> \<Longrightarrow> deriv G C m l (Cachera n)
[PROOF STEP]
apply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> G \<rhd> \<lbrace> (\<lambda>s0 s. True) \<rbrace> C,m,l \<lbrace> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rbrace> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n)
[PROOF STEP]
apply (rule GOTO)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> mbody_is C m (?M4 a aa b)
 2. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> get_ins (?M4 a aa b) l = Some (goto (?pc4 a aa b))
 3. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> MST\<down>(C, m) = Some (?Mspec4 a aa b, ?Minv4 a aa b, ?Anno4 a aa b)
 4. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>Q. ?Anno4 a aa b\<down>l = Some Q \<longrightarrow> (\<forall>s0 s. True \<longrightarrow> Q s0 s)
 5. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s. True \<longrightarrow> (case s of (ops, s, h) \<Rightarrow> \<lambda>k. |k| \<le> |h| + n) (heap s)
 6. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> G \<rhd> \<langle> SP_pre (?M4 a aa b) l (\<lambda>s0 s. True) \<rangle> C,m,?pc4 a aa b \<langle> SP_post (?M4 a aa b) l (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> SP_inv (?M4 a aa b) l (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n)
[PROOF STEP]
apply assumption+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>Q. Anno\<down>l = Some Q \<longrightarrow> (\<forall>s0 s. True \<longrightarrow> Q s0 s)
 2. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s. True \<longrightarrow> (case s of (ops, s, h) \<Rightarrow> \<lambda>k. |k| \<le> |h| + n) (heap s)
 3. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> G \<rhd> \<langle> SP_pre (a, aa, b) l (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> SP_post (a, aa, b) l (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> SP_inv (a, aa, b) l (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s. True \<longrightarrow> (case s of (ops, s, h) \<Rightarrow> \<lambda>k. |k| \<le> |h| + n) (heap s)
 2. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> G \<rhd> \<langle> SP_pre (a, aa, b) l (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> SP_post (a, aa, b) l (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> SP_inv (a, aa, b) l (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n)
[PROOF STEP]
apply (simp add: heap_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; G \<rhd> \<langle> (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n); mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> G \<rhd> \<langle> SP_pre (a, aa, b) l (\<lambda>s0 s. True) \<rangle> C,m,pc \<langle> SP_post (a, aa, b) l (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) \<rangle> SP_inv (a, aa, b) l (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n)
[PROOF STEP]
apply (erule CONSEQ)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s. SP_pre (a, aa, b) l (\<lambda>s0 s. True) s0 s \<longrightarrow> True
 2. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s t. (case s of (ops, s, h) \<Rightarrow> \<lambda>(k, v). |k| \<le> |h| + n) t \<longrightarrow> SP_post (a, aa, b) l (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) s0 s t
 3. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s k. (case s of (ops, s, h) \<Rightarrow> \<lambda>k. |k| \<le> |h| + n) k \<longrightarrow> SP_inv (a, aa, b) l (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n) s0 s k
[PROOF STEP]
apply (simp add: SP_pre_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s t. (case s of (ops, s, h) \<Rightarrow> \<lambda>(k, v). |k| \<le> |h| + n) t \<longrightarrow> SP_post (a, aa, b) l (\<lambda>s0 (ops, s, h) (k, v). |k| \<le> |h| + n) s0 s t
 2. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s k. (case s of (ops, s, h) \<Rightarrow> \<lambda>k. |k| \<le> |h| + n) k \<longrightarrow> SP_inv (a, aa, b) l (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n) s0 s k
[PROOF STEP]
apply (simp add: SP_post_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>ab ac ba ad. |ad| \<le> |ba| + n \<longrightarrow> (\<forall>ae af bb. (\<exists>l1 n. ((a, aa, b), l, (ae, af, bb), n, l1, ab, ac, ba) \<in> Step) \<longrightarrow> |ad| \<le> |bb| + n)
 2. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s k. (case s of (ops, s, h) \<Rightarrow> \<lambda>k. |k| \<le> |h| + n) k \<longrightarrow> SP_inv (a, aa, b) l (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n) s0 s k
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a aa b ab ac ba ad ae af bb l1 na. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc); |ad| \<le> |ba| + n; ((a, aa, b), l, (ae, af, bb), na, l1, ab, ac, ba) \<in> Step\<rbrakk> \<Longrightarrow> |ad| \<le> |bb| + n
 2. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s k. (case s of (ops, s, h) \<Rightarrow> \<lambda>k. |k| \<le> |h| + n) k \<longrightarrow> SP_inv (a, aa, b) l (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n) s0 s k
[PROOF STEP]
apply (drule GotoElim1, fastforce)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a aa b ab ac ba ad ae af bb l1 na. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc); |ad| \<le> |ba| + n; na = Suc 0 \<and> (ab, ac, ba) = (ae, af, bb) \<and> l1 = pc\<rbrakk> \<Longrightarrow> |ad| \<le> |bb| + n
 2. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s k. (case s of (ops, s, h) \<Rightarrow> \<lambda>k. |k| \<le> |h| + n) k \<longrightarrow> SP_inv (a, aa, b) l (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n) s0 s k
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>s0 s k. (case s of (ops, s, h) \<Rightarrow> \<lambda>k. |k| \<le> |h| + n) k \<longrightarrow> SP_inv (a, aa, b) l (\<lambda>s0 (ops, s, h) k. |k| \<le> |h| + n) s0 s k
[PROOF STEP]
apply (simp add: SP_inv_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc)\<rbrakk> \<Longrightarrow> \<forall>ab ac ba k. |k| \<le> |ba| + n \<longrightarrow> (\<forall>ad ae bb. (\<exists>l1 n. ((a, aa, b), l, (ad, ae, bb), n, l1, ab, ac, ba) \<in> Step) \<longrightarrow> |k| \<le> |bb| + n)
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b ab ac ba k ad ae bb l1 na. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc); |k| \<le> |ba| + n; ((a, aa, b), l, (ad, ae, bb), na, l1, ab, ac, ba) \<in> Step\<rbrakk> \<Longrightarrow> |k| \<le> |bb| + n
[PROOF STEP]
apply (drule GotoElim1, fastforce)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b ab ac ba k ad ae bb l1 na. \<lbrakk>MST\<down>(C, m) = Some (Mspec, Minv, Anno); Anno\<down>l = None; mbody_is C m (a, aa, b); get_ins (a, aa, b) l = Some (goto pc); |k| \<le> |ba| + n; na = Suc 0 \<and> (ab, ac, ba) = (ad, ae, bb) \<and> l1 = pc\<rbrakk> \<Longrightarrow> |k| \<le> |bb| + n
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma \<alpha>\<^sub>t\<^sub>i_covers_\<alpha>\<^sub>0_Var:
  assumes \_reach: "\ \<in> reachable_constraints P"
    and T: "T \<in> set P"
    and \: "welltyped_constraint_model \ (\@dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))"
    and \<xi>: "transaction_decl_subst \<xi> T"
    and \<sigma>: "transaction_fresh_subst \<sigma> T \"
    and \<alpha>: "transaction_renaming_subst \<alpha> P \"
    and P: "\<forall>T \<in> set P. admissible_transaction T"
    and x: "x \<in> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \"
  shows "\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\@dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in>
            timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
define a0 where "a0 \<equiv> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)"
[PROOF STATE]
proof (state)
this:
a0 \<equiv> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
define a0' where "a0' \<equiv> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\@dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \)"
[PROOF STATE]
proof (state)
this:
a0' \<equiv> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \)

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
define a3 where "a3 \<equiv> \<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \"
[PROOF STATE]
proof (state)
this:
a3 \<equiv> \<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
have \_wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s: "wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \)
[PROOF STEP]
by (metis reachable_constraints_wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s admissible_transactions_wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s P(1) \_reach)
[PROOF STATE]
proof (state)
this:
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \)

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
have T_adm: "admissible_transaction T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. admissible_transaction T
[PROOF STEP]
by (metis P(1) T)
[PROOF STATE]
proof (state)
this:
admissible_transaction T

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
note \<xi>_empty = admissible_transaction_decl_subst_empty[OF T_adm \<xi>]
[PROOF STATE]
proof (state)
this:
\<xi> = Var

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
note \<xi>\<sigma>\<alpha>_wt = transaction_decl_fresh_renaming_substs_wt[OF \<xi> \<sigma> \<alpha>]
[PROOF STATE]
proof (state)
this:
wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
have \_interp: "interpretation\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \"
    and \_wt: "wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \"
    and \_wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s: "wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. interpretation\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \ &&& wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \ &&& wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \)
[PROOF STEP]
by (metis \ welltyped_constraint_model_def constraint_model_def,
        metis \ welltyped_constraint_model_def,
        metis \ welltyped_constraint_model_def constraint_model_def)
[PROOF STATE]
proof (state)
this:
interpretation\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \
wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \)

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
have "\<Gamma>\<^sub>v x = Var Value \<or> (\<exists>a. \<Gamma>\<^sub>v x = Var (prot_atom.Atom a))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Gamma>\<^sub>v x = Var Value \<or> (\<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a)
[PROOF STEP]
using reachable_constraints_vars_TAtom_typed[OF \_reach P, of x]
          x vars\<^sub>s\<^sub>s\<^sub>t_is_fv\<^sub>s\<^sub>s\<^sub>t_bvars\<^sub>s\<^sub>s\<^sub>t[of "unlabel \"]
[PROOF STATE]
proof (prove)
using this:
x \<in> vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<Longrightarrow> \<Gamma>\<^sub>v x = Var Value \<or> (\<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a)
x \<in> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<union> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \

goal (1 subgoal):
 1. \<Gamma>\<^sub>v x = Var Value \<or> (\<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Gamma>\<^sub>v x = Var Value \<or> (\<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a)

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
hence "\ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3"
[PROOF STATE]
proof (prove)
using this:
\<Gamma>\<^sub>v x = Var Value \<or> (\<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a)

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<Gamma>\<^sub>v x = Var Value \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
 2. \<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
assume x_val: "\<Gamma>\<^sub>v x = TAtom Value"
[PROOF STATE]
proof (state)
this:
\<Gamma>\<^sub>v x = Var Value

goal (2 subgoals):
 1. \<Gamma>\<^sub>v x = Var Value \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
 2. \<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
show "\ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
proof (cases "\ x \<cdot>\<^sub>\<alpha> a0 = \ x \<cdot>\<^sub>\<alpha> a0'")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \ x \<cdot>\<^sub>\<alpha> a0 = \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
 2. \ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0'

goal (2 subgoals):
 1. \ x \<cdot>\<^sub>\<alpha> a0 = \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
 2. \ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
hence "\<exists>y \<in> fv_transaction T - set (transaction_fresh T).
              \ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<and> \<Gamma>\<^sub>v y = TAtom Value"
[PROOF STATE]
proof (prove)
using this:
\ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0'

goal (1 subgoal):
 1. \<exists>y\<in>fv_transaction T - set (transaction_fresh T). \ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<and> \<Gamma>\<^sub>v y = Var Value
[PROOF STEP]
using \<alpha>\<^sub>t\<^sub>i_covers_\<alpha>\<^sub>0_aux[OF \_reach T \ \<xi> \<sigma> \<alpha> P fv\<^sub>s\<^sub>s\<^sub>t_is_subterm_trms\<^sub>s\<^sub>s\<^sub>t[OF x], of _ x]
[PROOF STATE]
proof (prove)
using this:
\ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0'
\<lbrakk>Var x = Fun (Val ?n) [] \<or> Var x = Var x; Var x \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \) \<noteq> Var x \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \)\<rbrakk> \<Longrightarrow> \<exists>y\<in>fv_transaction T - set (transaction_fresh T). Unifier \ (Var x) ((\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y) \<and> \<Gamma>\<^sub>v y = Var Value

goal (1 subgoal):
 1. \<exists>y\<in>fv_transaction T - set (transaction_fresh T). \ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<and> \<Gamma>\<^sub>v y = Var Value
[PROOF STEP]
unfolding a0_def a0'_def
[PROOF STATE]
proof (prove)
using this:
\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \) \<noteq> \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \)
\<lbrakk>Var x = Fun (Val ?n) [] \<or> Var x = Var x; Var x \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \) \<noteq> Var x \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \)\<rbrakk> \<Longrightarrow> \<exists>y\<in>fv_transaction T - set (transaction_fresh T). Unifier \ (Var x) ((\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y) \<and> \<Gamma>\<^sub>v y = Var Value

goal (1 subgoal):
 1. \<exists>y\<in>fv_transaction T - set (transaction_fresh T). \ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<and> \<Gamma>\<^sub>v y = Var Value
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<exists>y\<in>fv_transaction T - set (transaction_fresh T). \ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<and> \<Gamma>\<^sub>v y = Var Value

goal (2 subgoals):
 1. \ x \<cdot>\<^sub>\<alpha> a0 = \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
 2. \ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>y\<in>fv_transaction T - set (transaction_fresh T). \ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<and> \<Gamma>\<^sub>v y = Var Value
[PROOF STEP]
obtain y where y:
          "y \<in> fv_transaction T - set (transaction_fresh T)"
          "\ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \"
          "\ x \<cdot>\<^sub>\<alpha> a0 = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0"
          "\ x \<cdot>\<^sub>\<alpha> a0' = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'"
          "\<Gamma>\<^sub>v y = TAtom Value"
[PROOF STATE]
proof (prove)
using this:
\<exists>y\<in>fv_transaction T - set (transaction_fresh T). \ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<and> \<Gamma>\<^sub>v y = Var Value

goal (1 subgoal):
 1. (\<And>y. \<lbrakk>y \<in> fv_transaction T - set (transaction_fresh T); \ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \; \ x \<cdot>\<^sub>\<alpha> a0 = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0; \ x \<cdot>\<^sub>\<alpha> a0' = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'; \<Gamma>\<^sub>v y = Var Value\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
y \<in> fv_transaction T - set (transaction_fresh T)
\ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \
\ x \<cdot>\<^sub>\<alpha> a0 = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0
\ x \<cdot>\<^sub>\<alpha> a0' = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'
\<Gamma>\<^sub>v y = Var Value

goal (2 subgoals):
 1. \ x \<cdot>\<^sub>\<alpha> a0 = \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
 2. \ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
y \<in> fv_transaction T - set (transaction_fresh T)
\ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \
\ x \<cdot>\<^sub>\<alpha> a0 = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0
\ x \<cdot>\<^sub>\<alpha> a0' = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'
\<Gamma>\<^sub>v y = Var Value
[PROOF STEP]
obtain n where n: "(\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ = Fun (Val n) []"
[PROOF STATE]
proof (prove)
using this:
y \<in> fv_transaction T - set (transaction_fresh T)
\ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \
\ x \<cdot>\<^sub>\<alpha> a0 = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0
\ x \<cdot>\<^sub>\<alpha> a0' = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'
\<Gamma>\<^sub>v y = Var Value

goal (1 subgoal):
 1. (\<And>n. (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ = Fun (Val n) [] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<Gamma>\<^sub>v_TAtom''(2)[of y] x x_val
              transaction_var_becomes_Val[
                OF reachable_constraints.step[OF \_reach T \<xi> \<sigma> \<alpha>] \ \<xi> \<sigma> \<alpha> P T, of y]
[PROOF STATE]
proof (prove)
using this:
y \<in> fv_transaction T - set (transaction_fresh T)
\ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \
\ x \<cdot>\<^sub>\<alpha> a0 = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0
\ x \<cdot>\<^sub>\<alpha> a0' = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'
\<Gamma>\<^sub>v y = Var Value
(fst y = Var Value) = (\<Gamma>\<^sub>v y = Var Value)
x \<in> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
\<Gamma>\<^sub>v x = Var Value
\<lbrakk>y \<in> fv_transaction T; fst y = Var Value\<rbrakk> \<Longrightarrow> \<exists>n. Fun (Val n) [] = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \

goal (1 subgoal):
 1. (\<And>n. (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ = Fun (Val n) [] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
(\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ = Fun (Val n) []

goal (2 subgoals):
 1. \ x \<cdot>\<^sub>\<alpha> a0 = \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
 2. \ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
have "a0 n \<noteq> a0' n"
           "y \<in> fv_transaction T"
           "y \<notin> set (transaction_fresh T)"
           "absc (a0 n) = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0"
           "absc (a0' n) = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (a0 n \<noteq> a0' n &&& y \<in> fv_transaction T) &&& y \<notin> set (transaction_fresh T) &&& \<langle>a0 n\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0 &&& \<langle>a0' n\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'
[PROOF STEP]
using y n False
[PROOF STATE]
proof (prove)
using this:
y \<in> fv_transaction T - set (transaction_fresh T)
\ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \
\ x \<cdot>\<^sub>\<alpha> a0 = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0
\ x \<cdot>\<^sub>\<alpha> a0' = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'
\<Gamma>\<^sub>v y = Var Value
(\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ = Fun (Val n) []
\ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0'

goal (1 subgoal):
 1. (a0 n \<noteq> a0' n &&& y \<in> fv_transaction T) &&& y \<notin> set (transaction_fresh T) &&& \<langle>a0 n\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0 &&& \<langle>a0' n\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
a0 n \<noteq> a0' n
y \<in> fv_transaction T
y \<notin> set (transaction_fresh T)
\<langle>a0 n\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0
\<langle>a0' n\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'

goal (2 subgoals):
 1. \ x \<cdot>\<^sub>\<alpha> a0 = \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
 2. \ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
hence 1: "(a0 n, a0' n) \<in> a3"
[PROOF STATE]
proof (prove)
using this:
a0 n \<noteq> a0' n
y \<in> fv_transaction T
y \<notin> set (transaction_fresh T)
\<langle>a0 n\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0
\<langle>a0' n\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'

goal (1 subgoal):
 1. (a0 n, a0' n) \<in> a3
[PROOF STEP]
unfolding a0_def a0'_def a3_def abs_term_implications_def
[PROOF STATE]
proof (prove)
using this:
\<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \) n \<noteq> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) n
y \<in> fv_transaction T
y \<notin> set (transaction_fresh T)
\<langle>\<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \) n\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)
\<langle>\<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) n\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \)

goal (1 subgoal):
 1. (\<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \) n, \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) n) \<in> {uu_. \<exists>s t x. uu_ = (s, t) \<and> s \<noteq> t \<and> x \<in> fv_transaction T \<and> x \<notin> set (transaction_fresh T) \<and> \<langle>s\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) x \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \) \<and> \<langle>t\<rangle>\<^sub>a\<^sub>b\<^sub>s = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) x \<cdot> \ \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \)}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(a0 n, a0' n) \<in> a3

goal (2 subgoals):
 1. \ x \<cdot>\<^sub>\<alpha> a0 = \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
 2. \ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
have 2: "\ x \<cdot>\<^sub>\<alpha> a0' \<in> set \<langle>a0 n --\<guillemotright> a0' n\<rangle>\<langle>\ x \<cdot>\<^sub>\<alpha> a0\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> a0' \<in> set \<langle>a0 n --\<guillemotright> a0' n\<rangle>\<langle>\ x \<cdot>\<^sub>\<alpha> a0\<rangle>
[PROOF STEP]
using y n timpl_apply_const
[PROOF STATE]
proof (prove)
using this:
y \<in> fv_transaction T - set (transaction_fresh T)
\ x = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \
\ x \<cdot>\<^sub>\<alpha> a0 = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0
\ x \<cdot>\<^sub>\<alpha> a0' = (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ \<cdot>\<^sub>\<alpha> a0'
\<Gamma>\<^sub>v y = Var Value
(\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) y \<cdot> \ = Fun (Val n) []
Fun (Abs ?b) [] \<in> set \<langle>?a --\<guillemotright> ?b\<rangle>\<langle>Fun (Abs ?a) []\<rangle>

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> a0' \<in> set \<langle>a0 n --\<guillemotright> a0' n\<rangle>\<langle>\ x \<cdot>\<^sub>\<alpha> a0\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\ x \<cdot>\<^sub>\<alpha> a0' \<in> set \<langle>a0 n --\<guillemotright> a0' n\<rangle>\<langle>\ x \<cdot>\<^sub>\<alpha> a0\<rangle>

goal (2 subgoals):
 1. \ x \<cdot>\<^sub>\<alpha> a0 = \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
 2. \ x \<cdot>\<^sub>\<alpha> a0 \<noteq> \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
using timpl_closure.TI[OF timpl_closure.FP 1] 2
              term_variants_pred_iff_in_term_variants[
                of "(\<lambda>_. [])(Abs (a0 n) := [Abs (a0' n)])"]
[PROOF STATE]
proof (prove)
using this:
term_variants_pred ((\<lambda>_. [])(Abs (a0 n) := [Abs (a0' n)])) ?t ?s \<Longrightarrow> ?s \<in> timpl_closure ?t a3
\ x \<cdot>\<^sub>\<alpha> a0' \<in> set \<langle>a0 n --\<guillemotright> a0' n\<rangle>\<langle>\ x \<cdot>\<^sub>\<alpha> a0\<rangle>
term_variants_pred ((\<lambda>_. [])(Abs (a0 n) := [Abs (a0' n)])) ?t ?s = (?s \<in> set (term_variants ((\<lambda>_. [])(Abs (a0 n) := [Abs (a0' n)])) ?t))

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
unfolding timpl_closure_set_def timpl_apply_term_def
[PROOF STATE]
proof (prove)
using this:
term_variants_pred ((\<lambda>_. [])(Abs (a0 n) := [Abs (a0' n)])) ?t ?s \<Longrightarrow> ?s \<in> timpl_closure ?t a3
\ x \<cdot>\<^sub>\<alpha> a0' \<in> set (term_variants ((\<lambda>_. [])(Abs (a0 n) := [Abs (a0' n)])) (\ x \<cdot>\<^sub>\<alpha> a0))
term_variants_pred ((\<lambda>_. [])(Abs (a0 n) := [Abs (a0' n)])) ?t ?s = (?s \<in> set (term_variants ((\<lambda>_. [])(Abs (a0 n) := [Abs (a0' n)])) ?t))

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> a0' \<in> (\<Union>t\<in>{\ x \<cdot>\<^sub>\<alpha> a0}. timpl_closure t a3)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> a0 = \ x \<cdot>\<^sub>\<alpha> a0' \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
qed (auto intro: timpl_closure_setI)
[PROOF STATE]
proof (state)
this:
\ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
assume "\<exists>a. \<Gamma>\<^sub>v x = TAtom (Atom a)"
[PROOF STATE]
proof (state)
this:
\<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a
[PROOF STEP]
obtain a where x_atom: "\<Gamma>\<^sub>v x = TAtom (Atom a)"
[PROOF STATE]
proof (prove)
using this:
\<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a

goal (1 subgoal):
 1. (\<And>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by moura
[PROOF STATE]
proof (state)
this:
\<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
obtain f T where fT: "\ x = Fun f T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>f T. \ x = Fun f T \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using interpretation_grounds[OF \_interp, of "Var x"]
[PROOF STATE]
proof (prove)
using this:
fv (Var x \<cdot> \) = {}

goal (1 subgoal):
 1. (\<And>f T. \ x = Fun f T \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases "\ x") auto
[PROOF STATE]
proof (state)
this:
\ x = Fun f T

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
have fT_atom: "\<Gamma> (Fun f T) = TAtom (Atom a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Gamma> (Fun f T) = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a
[PROOF STEP]
using wt_subst_trm''[OF \_wt, of "Var x"] x_atom fT
[PROOF STATE]
proof (prove)
using this:
\<Gamma> (Var x) = \<Gamma> (Var x \<cdot> \)
\<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a
\ x = Fun f T

goal (1 subgoal):
 1. \<Gamma> (Fun f T) = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Gamma> (Fun f T) = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
have T: "T = []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. T = []
[PROOF STEP]
using fT wf_trm_subst[OF \_wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s, of "Var x"] const_type_inv_wf[OF fT_atom]
[PROOF STATE]
proof (prove)
using this:
\ x = Fun f T
wf\<^sub>t\<^sub>r\<^sub>m (Var x) = wf\<^sub>t\<^sub>r\<^sub>m (Var x \<cdot> \)
wf\<^sub>t\<^sub>r\<^sub>m (Fun f T) \<Longrightarrow> T = []

goal (1 subgoal):
 1. T = []
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
T = []

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
have f: "\<not>is_Val f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> is_Val f
[PROOF STEP]
using fT_atom
[PROOF STATE]
proof (prove)
using this:
\<Gamma> (Fun f T) = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a

goal (1 subgoal):
 1. \<not> is_Val f
[PROOF STEP]
unfolding is_Val_def
[PROOF STATE]
proof (prove)
using this:
\<Gamma> (Fun f T) = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a

goal (1 subgoal):
 1. \<nexists>x3. f = Val x3
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> is_Val f

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
have "\ x \<cdot>\<^sub>\<alpha> b = \ x" for b
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> b = \ x
[PROOF STEP]
using T fT abs_term_apply_const(2)[OF f]
[PROOF STATE]
proof (prove)
using this:
T = []
\ x = Fun f T
Fun f [] \<cdot>\<^sub>\<alpha> ?a = Fun f []

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> b = \ x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\ x \<cdot>\<^sub>\<alpha> ?b50 = \ x

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a \<Longrightarrow> \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
thus "\ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3"
[PROOF STATE]
proof (prove)
using this:
\ x \<cdot>\<^sub>\<alpha> ?b50 = \ x

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3
[PROOF STEP]
by (auto intro: timpl_closure_setI)
[PROOF STATE]
proof (state)
this:
\ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\ x \<cdot>\<^sub>\<alpha> a0' \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> a0} a3

goal (1 subgoal):
 1. \ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)
[PROOF STEP]
by (metis a0_def a0'_def a3_def)
[PROOF STATE]
proof (state)
this:
\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\ @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) \) \<in> timpl_closure_set {\ x \<cdot>\<^sub>\<alpha> \<alpha>\<^sub>0 (db\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \)} (\<alpha>\<^sub>t\<^sub>i \ T (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M_ok [simp]:
  assumes "shadow_root_ptr |\<in>| shadow_root_ptr_kinds h"
  shows "h \<turnstile> ok (delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M shadow_root_ptr)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h \<turnstile> ok delete_M shadow_root_ptr
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
shadow_root_ptr |\<in>| shadow_root_ptr_kinds h

goal (1 subgoal):
 1. h \<turnstile> ok delete_M shadow_root_ptr
[PROOF STEP]
by(auto simp add: delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M_def delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def split: prod.splits)


[STATEMENT]
lemma le: "allpolys isnpoly p \<Longrightarrow> Ifm vs bs (le p) = Ifm vs bs (Le p)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. allpolys isnpoly p \<Longrightarrow> Ifm vs bs (le p) = Ifm vs bs (Le p)
[PROOF STEP]
apply (simp add: le_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. allpolys isnpoly p \<Longrightarrow> Ifm vs bs (case p of CP (C c) \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | CP _ \<Rightarrow> Le p | _ \<Rightarrow> Le p) = (Itm vs bs p \<le> (0::'a))
[PROOF STEP]
apply (cases p)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>x1. \<lbrakk>allpolys isnpoly p; p = CP x1\<rbrakk> \<Longrightarrow> Ifm vs bs (case p of CP (C c) \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | CP _ \<Rightarrow> Le p | _ \<Rightarrow> Le p) = (Itm vs bs p \<le> (0::'a))
 2. \<And>x2. \<lbrakk>allpolys isnpoly p; p = tm.Bound x2\<rbrakk> \<Longrightarrow> Ifm vs bs (case p of CP (C c) \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | CP _ \<Rightarrow> Le p | _ \<Rightarrow> Le p) = (Itm vs bs p \<le> (0::'a))
 3. \<And>x31 x32. \<lbrakk>allpolys isnpoly p; p = tm.Add x31 x32\<rbrakk> \<Longrightarrow> Ifm vs bs (case p of CP (C c) \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | CP _ \<Rightarrow> Le p | _ \<Rightarrow> Le p) = (Itm vs bs p \<le> (0::'a))
 4. \<And>x41 x42. \<lbrakk>allpolys isnpoly p; p = tm.Mul x41 x42\<rbrakk> \<Longrightarrow> Ifm vs bs (case p of CP (C c) \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | CP _ \<Rightarrow> Le p | _ \<Rightarrow> Le p) = (Itm vs bs p \<le> (0::'a))
 5. \<And>x5. \<lbrakk>allpolys isnpoly p; p = tm.Neg x5\<rbrakk> \<Longrightarrow> Ifm vs bs (case p of CP (C c) \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | CP _ \<Rightarrow> Le p | _ \<Rightarrow> Le p) = (Itm vs bs p \<le> (0::'a))
 6. \<And>x61 x62. \<lbrakk>allpolys isnpoly p; p = tm.Sub x61 x62\<rbrakk> \<Longrightarrow> Ifm vs bs (case p of CP (C c) \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | CP _ \<Rightarrow> Le p | _ \<Rightarrow> Le p) = (Itm vs bs p \<le> (0::'a))
 7. \<And>x71 x72 x73. \<lbrakk>allpolys isnpoly p; p = CNP x71 x72 x73\<rbrakk> \<Longrightarrow> Ifm vs bs (case p of CP (C c) \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | CP _ \<Rightarrow> Le p | _ \<Rightarrow> Le p) = (Itm vs bs p \<le> (0::'a))
[PROOF STEP]
apply simp_all
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x1. \<lbrakk>isnpoly x1; p = CP x1\<rbrakk> \<Longrightarrow> Ifm vs bs (case x1 of C c \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | _ \<Rightarrow> Le p) = (\<lparr>x1\<rparr>\<^sub>p\<^bsup>vs\<^esup> \<le> (0::'a))
[PROOF STEP]
apply (rename_tac poly, case_tac poly)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>poly x1. \<lbrakk>isnpoly poly; p = CP poly; poly = C x1\<rbrakk> \<Longrightarrow> Ifm vs bs (case poly of C c \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | _ \<Rightarrow> Le p) = (\<lparr>poly\<rparr>\<^sub>p\<^bsup>vs\<^esup> \<le> (0::'a))
 2. \<And>poly x2. \<lbrakk>isnpoly poly; p = CP poly; poly = poly.Bound x2\<rbrakk> \<Longrightarrow> Ifm vs bs (case poly of C c \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | _ \<Rightarrow> Le p) = (\<lparr>poly\<rparr>\<^sub>p\<^bsup>vs\<^esup> \<le> (0::'a))
 3. \<And>poly x31 x32. \<lbrakk>isnpoly poly; p = CP poly; poly = poly.Add x31 x32\<rbrakk> \<Longrightarrow> Ifm vs bs (case poly of C c \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | _ \<Rightarrow> Le p) = (\<lparr>poly\<rparr>\<^sub>p\<^bsup>vs\<^esup> \<le> (0::'a))
 4. \<And>poly x41 x42. \<lbrakk>isnpoly poly; p = CP poly; poly = poly.Sub x41 x42\<rbrakk> \<Longrightarrow> Ifm vs bs (case poly of C c \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | _ \<Rightarrow> Le p) = (\<lparr>poly\<rparr>\<^sub>p\<^bsup>vs\<^esup> \<le> (0::'a))
 5. \<And>poly x51 x52. \<lbrakk>isnpoly poly; p = CP poly; poly = poly.Mul x51 x52\<rbrakk> \<Longrightarrow> Ifm vs bs (case poly of C c \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | _ \<Rightarrow> Le p) = (\<lparr>poly\<rparr>\<^sub>p\<^bsup>vs\<^esup> \<le> (0::'a))
 6. \<And>poly x6. \<lbrakk>isnpoly poly; p = CP poly; poly = poly.Neg x6\<rbrakk> \<Longrightarrow> Ifm vs bs (case poly of C c \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | _ \<Rightarrow> Le p) = (\<lparr>poly\<rparr>\<^sub>p\<^bsup>vs\<^esup> \<le> (0::'a))
 7. \<And>poly x71 x72. \<lbrakk>isnpoly poly; p = CP poly; poly = Pw x71 x72\<rbrakk> \<Longrightarrow> Ifm vs bs (case poly of C c \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | _ \<Rightarrow> Le p) = (\<lparr>poly\<rparr>\<^sub>p\<^bsup>vs\<^esup> \<le> (0::'a))
 8. \<And>poly x81 x82 x83. \<lbrakk>isnpoly poly; p = CP poly; poly = CN x81 x82 x83\<rbrakk> \<Longrightarrow> Ifm vs bs (case poly of C c \<Rightarrow> if 0\<ge>\<^sub>N c then T else F | _ \<Rightarrow> Le p) = (\<lparr>poly\<rparr>\<^sub>p\<^bsup>vs\<^esup> \<le> (0::'a))
[PROOF STEP]
apply (simp_all add: isnpoly_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done