[STATEMENT]
lemma (in valid_ownership_and_sharing) outstanding_non_volatile_write_disj:
assumes i_bound: "i < length ts"
assumes j_bound: "j < length ts"
assumes neq_i_j: "i \<noteq> j"
assumes ith: "ts!i = (p\<^sub>i,is\<^sub>i,\<theta>\<^sub>i,sb\<^sub>i,\<D>\<^sub>i,\<O>\<^sub>i,\<R>\<^sub>i)"
assumes jth: "ts!j = (p\<^sub>j,is\<^sub>j,\<theta>\<^sub>j,sb\<^sub>j,\<D>\<^sub>j,\<O>\<^sub>j,\<R>\<^sub>j)"
shows "outstanding_refs (is_non_volatile_Write\<^sub>s\<^sub>b) (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter>
        (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union>
         outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union>
         outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union>
         (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) -
          read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union>
         (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))
        ) = {}" (is "?non_vol_writes_i \<inter> ?not_volatile_j = {}")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
note nro_i = no_outstanding_write_to_read_only_memory [OF i_bound ith]
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory \<S> sb\<^sub>i

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
note nro_j = no_outstanding_write_to_read_only_memory [OF j_bound jth]
[PROOF STATE]
proof (state)
this:
no_write_to_read_only_memory \<S> sb\<^sub>j

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
note nvo_j = outstanding_non_volatile_refs_owned_or_read_only [OF j_bound jth]
[PROOF STATE]
proof (state)
this:
non_volatile_owned_or_read_only False \<S> \<O>\<^sub>j sb\<^sub>j

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
note nvo_i = outstanding_non_volatile_refs_owned_or_read_only [OF i_bound ith]
[PROOF STATE]
proof (state)
this:
non_volatile_owned_or_read_only False \<S> \<O>\<^sub>i sb\<^sub>i

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
from outstanding_volatile_writes_unowned_by_others [OF i_bound j_bound neq_i_j ith jth]
[PROOF STATE]
proof (chain)
picking this:
(\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>i = {}
[PROOF STEP]
have dist: "(\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>i = {}"
[PROOF STATE]
proof (prove)
using this:
(\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>i = {}

goal (1 subgoal):
 1. (\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>i = {}
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>i = {}

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
from outstanding_volatile_writes_unowned_by_others [OF j_bound i_bound neq_i_j [symmetric] jth ith]
[PROOF STATE]
proof (chain)
picking this:
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j = {}
[PROOF STEP]
have dist_j: "(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j = {}"
[PROOF STATE]
proof (prove)
using this:
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j = {}

goal (1 subgoal):
 1. (\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j = {}
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j = {}

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
note own_dist = ownership_distinct [OF i_bound j_bound neq_i_j ith jth]
[PROOF STATE]
proof (state)
this:
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> (\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) = {}

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
from sharing_consis [OF j_bound jth]
[PROOF STATE]
proof (chain)
picking this:
sharing_consistent \<S> \<O>\<^sub>j sb\<^sub>j
[PROOF STEP]
have consis_j: "sharing_consistent \<S> \<O>\<^sub>j sb\<^sub>j"
[PROOF STATE]
proof (prove)
using this:
sharing_consistent \<S> \<O>\<^sub>j sb\<^sub>j

goal (1 subgoal):
 1. sharing_consistent \<S> \<O>\<^sub>j sb\<^sub>j
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
sharing_consistent \<S> \<O>\<^sub>j sb\<^sub>j

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
from sharing_consis [OF i_bound ith]
[PROOF STATE]
proof (chain)
picking this:
sharing_consistent \<S> \<O>\<^sub>i sb\<^sub>i
[PROOF STEP]
have consis_i: "sharing_consistent \<S> \<O>\<^sub>i sb\<^sub>i"
[PROOF STATE]
proof (prove)
using this:
sharing_consistent \<S> \<O>\<^sub>i sb\<^sub>i

goal (1 subgoal):
 1. sharing_consistent \<S> \<O>\<^sub>i sb\<^sub>i
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
sharing_consistent \<S> \<O>\<^sub>i sb\<^sub>i

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
let ?take_j = "(takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
let ?drop_j = "(dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
assume x_in_take_i: "x \<in> ?non_vol_writes_i"
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i)

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
assume x_in_j: "x \<in> ?not_volatile_j"
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
from x_in_take_i
[PROOF STATE]
proof (chain)
picking this:
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i)
[PROOF STEP]
have x_in_i: "x \<in> outstanding_refs (is_non_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i"
[PROOF STATE]
proof (prove)
using this:
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i)

goal (1 subgoal):
 1. x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>i
[PROOF STEP]
by (auto dest: outstanding_refs_takeWhileD)
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>i

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
from non_volatile_owned_or_read_only_outstanding_non_volatile_writes [OF nvo_i] x_in_i
[PROOF STATE]
proof (chain)
picking this:
outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>i \<subseteq> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>i
[PROOF STEP]
have x_in_owns_acq_i: "x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i"
[PROOF STATE]
proof (prove)
using this:
outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>i \<subseteq> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>i

goal (1 subgoal):
 1. x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. False
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. False
[PROOF STEP]
assume x_in_j: "x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j"
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j

goal (1 subgoal):
 1. False
[PROOF STEP]
with dist_j
[PROOF STATE]
proof (chain)
picking this:
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j = {}
x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j
[PROOF STEP]
have x_notin: "x \<notin> (\<O>\<^sub>i \<union> all_acquired sb\<^sub>i)"
[PROOF STATE]
proof (prove)
using this:
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j = {}
x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j

goal (1 subgoal):
 1. x \<notin> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<notin> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i

goal (1 subgoal):
 1. False
[PROOF STEP]
with x_in_owns_acq_i
[PROOF STATE]
proof (chain)
picking this:
x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
x \<notin> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
x \<notin> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
assume x_in_j: "x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j"
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j

goal (1 subgoal):
 1. False
[PROOF STEP]
from non_volatile_owned_or_read_only_outstanding_non_volatile_writes [OF nvo_j] x_in_j
[PROOF STATE]
proof (chain)
picking this:
outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<subseteq> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j
[PROOF STEP]
have "x \<in> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j"
[PROOF STATE]
proof (prove)
using this:
outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<subseteq> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j

goal (1 subgoal):
 1. x \<in> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<in> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j

goal (1 subgoal):
 1. False
[PROOF STEP]
with x_in_owns_acq_i own_dist
[PROOF STATE]
proof (chain)
picking this:
x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> (\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) = {}
x \<in> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> (\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) = {}
x \<in> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
assume x_in_j: "x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b ?drop_j"
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
from non_volatile_owned_or_read_only_drop [OF nvo_j]
[PROOF STATE]
proof (chain)
picking this:
non_volatile_owned_or_read_only True (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<S>) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
have nvo': "non_volatile_owned_or_read_only True (share ?take_j \<S>) (acquired True ?take_j \<O>\<^sub>j) ?drop_j"
[PROOF STATE]
proof (prove)
using this:
non_volatile_owned_or_read_only True (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<S>) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. non_volatile_owned_or_read_only True (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<S>) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
non_volatile_owned_or_read_only True (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<S>) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
from non_volatile_owned_or_read_only_outstanding_refs [OF nvo'] x_in_j
[PROOF STATE]
proof (chain)
picking this:
outstanding_refs (Not \<circ> is_volatile) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
have "x \<in> acquired True ?take_j \<O>\<^sub>j \<union> all_acquired ?drop_j \<union>
	  read_only_reads (acquired True ?take_j \<O>\<^sub>j) ?drop_j"
[PROOF STATE]
proof (prove)
using this:
outstanding_refs (Not \<circ> is_volatile) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. x \<in> acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
by (auto simp add: misc_outstanding_refs_convs)
[PROOF STATE]
proof (state)
this:
x \<in> acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
x \<in> acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
from acquired_append [of True ?take_j ?drop_j \<O>\<^sub>j] acquired_all_acquired [of True ?take_j \<O>\<^sub>j]
	  all_acquired_append [of ?take_j ?drop_j]
[PROOF STATE]
proof (chain)
picking this:
acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j = acquired (True \<or> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<noteq> {}) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j)
acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<subseteq> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) = all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
have "acquired True ?take_j \<O>\<^sub>j \<union> all_acquired ?drop_j \<subseteq> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j"
[PROOF STATE]
proof (prove)
using this:
acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j = acquired (True \<or> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<noteq> {}) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j)
acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<subseteq> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) = all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j

goal (1 subgoal):
 1. False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
x \<in> acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j
[PROOF STEP]
have "x \<in> read_only_reads (acquired True ?take_j \<O>\<^sub>j) ?drop_j"
[PROOF STATE]
proof (prove)
using this:
x \<in> acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j

goal (1 subgoal):
 1. x \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
using x_in_owns_acq_i own_dist
[PROOF STATE]
proof (prove)
using this:
x \<in> acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> \<O>\<^sub>j \<union> all_acquired sb\<^sub>j
x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> (\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) = {}

goal (1 subgoal):
 1. x \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
with read_only_reads_unowned [OF j_bound i_bound neq_i_j [symmetric] jth ith] x_in_owns_acq_i
[PROOF STATE]
proof (chain)
picking this:
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) = {}
x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
x \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) = {}
x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
x \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<O>\<^sub>j) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
assume x_in_j: "x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b ?take_j"
[PROOF STATE]
proof (state)
this:
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
assume x_notin: "x \<notin> read_only_reads \<O>\<^sub>j ?take_j"
[PROOF STATE]
proof (state)
this:
x \<notin> read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
from non_volatile_owned_or_read_only_append [where xs="?take_j" and ys="?drop_j"] nvo_j
[PROOF STATE]
proof (chain)
picking this:
non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) = (non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<and> non_volatile_owned_or_read_only (?pending_write \<or> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<noteq> {}) (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) ?\<S>) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) ?\<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))
non_volatile_owned_or_read_only False \<S> \<O>\<^sub>j sb\<^sub>j
[PROOF STEP]
have "non_volatile_owned_or_read_only False \<S> \<O>\<^sub>j ?take_j"
[PROOF STATE]
proof (prove)
using this:
non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) = (non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<and> non_volatile_owned_or_read_only (?pending_write \<or> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<noteq> {}) (share (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) ?\<S>) (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) ?\<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))
non_volatile_owned_or_read_only False \<S> \<O>\<^sub>j sb\<^sub>j

goal (1 subgoal):
 1. non_volatile_owned_or_read_only False \<S> \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
non_volatile_owned_or_read_only False \<S> \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
from non_volatile_owned_or_read_only_outstanding_refs [OF this]  x_in_j x_notin
[PROOF STATE]
proof (chain)
picking this:
outstanding_refs (Not \<circ> is_volatile) (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
x \<notin> read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
have "x \<in> \<O>\<^sub>j \<union> all_acquired ?take_j"
[PROOF STATE]
proof (prove)
using this:
outstanding_refs (Not \<circ> is_volatile) (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
x \<notin> read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
by (auto simp add: misc_outstanding_refs_convs )
[PROOF STATE]
proof (state)
this:
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
with all_acquired_append [of ?take_j ?drop_j] x_in_owns_acq_i own_dist
[PROOF STATE]
proof (chain)
picking this:
all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) = all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> (\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) = {}
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) = all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> (\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) = {}
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j); x \<notin> read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<lbrakk>x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j); x \<notin> read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<lbrakk>x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j); x \<notin> read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
assume x_in_j: "x \<in> \<O>\<^sub>j \<union> all_acquired ?take_j"
[PROOF STATE]
proof (state)
this:
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. False
[PROOF STEP]
from all_acquired_append [of ?take_j ?drop_j]
[PROOF STATE]
proof (chain)
picking this:
all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) = all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
have "all_acquired ?take_j \<subseteq> all_acquired sb\<^sub>j"
[PROOF STATE]
proof (prove)
using this:
all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j @ dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) = all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> all_acquired (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> all_acquired sb\<^sub>j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> all_acquired sb\<^sub>j

goal (1 subgoal):
 1. False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> all_acquired sb\<^sub>j
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> all_acquired sb\<^sub>j

goal (1 subgoal):
 1. False
[PROOF STEP]
using x_in_owns_acq_i own_dist
[PROOF STATE]
proof (prove)
using this:
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<subseteq> all_acquired sb\<^sub>j
x \<in> \<O>\<^sub>i \<union> all_acquired sb\<^sub>i
(\<O>\<^sub>i \<union> all_acquired sb\<^sub>i) \<inter> (\<O>\<^sub>j \<union> all_acquired sb\<^sub>j) = {}

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> False
\<lbrakk>x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j); x \<notin> read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> False
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> False
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> False
\<lbrakk>x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j); x \<notin> read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> False
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> False

goal (1 subgoal):
 1. False
[PROOF STEP]
using x_in_take_i x_in_j
[PROOF STATE]
proof (prove)
using this:
x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<Longrightarrow> False
x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> False
\<lbrakk>x \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j); x \<notin> read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> False
x \<in> \<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> False
x \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i)
x \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))

goal (1 subgoal):
 1. False
[PROOF STEP]
by (auto simp add: misc_outstanding_refs_convs)
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>?x2 \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i); ?x2 \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?x2 \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i); ?x2 \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?x2 \<in> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i); ?x2 \<in> outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>i) \<inter> (outstanding_refs is_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b sb\<^sub>j \<union> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<union> (outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) - read_only_reads \<O>\<^sub>j (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)) \<union> (\<O>\<^sub>j \<union> all_acquired (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))) = {}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma checkDeadProcs_gState_progress_rel:
  assumes "gState_inv prog g"
  shows "(g, checkDeadProcs g) \<in> gState_progress_rel prog"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (g, checkDeadProcs g) \<in> gState_progress_rel prog
[PROOF STEP]
using assms cleanChans_length[where cs="channels g"]
      cleanChans_channel_inv[where cs="channels g"]
[PROOF STATE]
proof (prove)
using this:
gState_inv prog g
length (cleanChans ?dchans (gState.channels g)) = length (gState.channels g)
set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans ?dchans (gState.channels g)) \<subseteq> Collect channel_inv

goal (1 subgoal):
 1. (g, checkDeadProcs g) \<in> gState_progress_rel prog
[PROOF STEP]
unfolding checkDeadProcs_def
[PROOF STATE]
proof (prove)
using this:
gState_inv prog g
length (cleanChans ?dchans (gState.channels g)) = length (gState.channels g)
set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans ?dchans (gState.channels g)) \<subseteq> Collect channel_inv

goal (1 subgoal):
 1. (g, let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g) \<in> gState_progress_rel prog
[PROOF STEP]
apply (intro gState_progress_relI)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> gState_inv prog g
 2. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> gState_inv prog (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g)
 3. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> length (gState.channels g) \<le> length (gState.channels (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g))
 4. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> dom (lm.\<alpha> (gState.vars g)) = dom (lm.\<alpha> (gState.vars (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g)))
[PROOF STEP]
apply assumption
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> gState_inv prog (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g)
 2. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> length (gState.channels g) \<le> length (gState.channels (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g))
 3. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> dom (lm.\<alpha> (gState.vars g)) = dom (lm.\<alpha> (gState.vars (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g)))
[PROOF STEP]
apply (clarsimp split: if_splits prod.splits)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a x1 aa b. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv; a; removeProcs (procs g) = (x1, True, aa, b)\<rbrakk> \<Longrightarrow> gState_inv prog (g\<lparr>procs := aa, gState.channels := cleanChans b (gState.channels g)\<rparr>)
 2. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> length (gState.channels g) \<le> length (gState.channels (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g))
 3. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> dom (lm.\<alpha> (gState.vars g)) = dom (lm.\<alpha> (gState.vars (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g)))
[PROOF STEP]
apply (frule removeProcs_length)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a x1 aa b. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv; a; removeProcs (procs g) = (x1, True, aa, b); length aa \<le> length (procs g)\<rbrakk> \<Longrightarrow> gState_inv prog (g\<lparr>procs := aa, gState.channels := cleanChans b (gState.channels g)\<rparr>)
 2. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> length (gState.channels g) \<le> length (gState.channels (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g))
 3. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> dom (lm.\<alpha> (gState.vars g)) = dom (lm.\<alpha> (gState.vars (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g)))
[PROOF STEP]
apply (frule removeProcs_subset)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a x1 aa b. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv; a; removeProcs (procs g) = (x1, True, aa, b); length aa \<le> length (procs g); set aa \<subseteq> set (procs g)\<rbrakk> \<Longrightarrow> gState_inv prog (g\<lparr>procs := aa, gState.channels := cleanChans b (gState.channels g)\<rparr>)
 2. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> length (gState.channels g) \<le> length (gState.channels (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g))
 3. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> dom (lm.\<alpha> (gState.vars g)) = dom (lm.\<alpha> (gState.vars (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g)))
[PROOF STEP]
apply (auto simp add: gState_inv_def cl_inv_def)[]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> length (gState.channels g) \<le> length (gState.channels (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g))
 2. \<lbrakk>gState_inv prog g; \<And>dchans. length (cleanChans dchans (gState.channels g)) = length (gState.channels g); \<And>dchans. set (gState.channels g) \<subseteq> Collect channel_inv \<Longrightarrow> set (cleanChans dchans (gState.channels g)) \<subseteq> Collect channel_inv\<rbrakk> \<Longrightarrow> dom (lm.\<alpha> (gState.vars g)) = dom (lm.\<alpha> (gState.vars (let (uu_, soDied, procs, dchans) = removeProcs (procs g) in if soDied then g\<lparr>procs := procs, gState.channels := cleanChans dchans (gState.channels g)\<rparr> else g)))
[PROOF STEP]
apply (clarsimp split: if_splits prod.splits)+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma unique_session_keys:
     "\<lbrakk>Says Server A
          \<lbrace>nb, Crypt (shrK A) \<lbrace>Agent B, Key K, na\<rbrace>, X\<rbrace> \<in> set evs;
        Says Server A'
          \<lbrace>nb', Crypt (shrK A') \<lbrace>Agent B', Key K, na'\<rbrace>, X'\<rbrace> \<in> set evs;
        evs \<in> yahalom\<rbrakk>
     \<Longrightarrow> A=A' \<and> B=B' \<and> na=na' \<and> nb=nb'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says Server A \<lbrace>nb, Crypt (shrK A) \<lbrace>Agent B, Key K, na\<rbrace>, X\<rbrace> \<in> set evs; Says Server A' \<lbrace>nb', Crypt (shrK A') \<lbrace>Agent B', Key K, na'\<rbrace>, X'\<rbrace> \<in> set evs; evs \<in> yahalom\<rbrakk> \<Longrightarrow> A = A' \<and> B = B' \<and> na = na' \<and> nb = nb'
[PROOF STEP]
apply (erule rev_mp, erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. evs \<in> yahalom \<Longrightarrow> Says Server A' \<lbrace>nb', Crypt (shrK A') \<lbrace>Agent B', Key K, na'\<rbrace>, X'\<rbrace> \<in> set evs \<longrightarrow> Says Server A \<lbrace>nb, Crypt (shrK A) \<lbrace>Agent B, Key K, na\<rbrace>, X\<rbrace> \<in> set evs \<longrightarrow> A = A' \<and> B = B' \<and> na = na' \<and> nb = nb'
[PROOF STEP]
apply (erule yahalom.induct, simp_all)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs3 KAB Ba NB Aa NA. \<lbrakk>evs3 \<in> yahalom; Says Server A' \<lbrace>nb', Crypt (shrK A') \<lbrace>Agent B', Key K, na'\<rbrace>, X'\<rbrace> \<in> set evs3 \<longrightarrow> Says Server A \<lbrace>nb, Crypt (shrK A) \<lbrace>Agent B, Key K, na\<rbrace>, X\<rbrace> \<in> set evs3 \<longrightarrow> A = A' \<and> B = B' \<and> na = na' \<and> nb = nb'; Key KAB \<notin> used evs3; Gets Server \<lbrace>Agent Ba, Nonce NB, Crypt (shrK Ba) \<lbrace>Agent Aa, Nonce NA\<rbrace>\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> (A' = Aa \<and> nb' = Nonce NB \<and> A' = Aa \<and> B' = Ba \<and> K = KAB \<and> na' = Nonce NA \<and> X' = Crypt (shrK Ba) \<lbrace>Agent Aa, Agent Ba, Key KAB, Nonce NB\<rbrace> \<longrightarrow> Says Server A \<lbrace>nb, Crypt (shrK A) \<lbrace>Agent B, Key KAB, na\<rbrace>, X\<rbrace> \<in> set evs3 \<longrightarrow> A = Aa \<and> B = Ba \<and> na = Nonce NA \<and> nb = Nonce NB) \<and> (Says Server A' \<lbrace>nb', Crypt (shrK A') \<lbrace>Agent B', Key K, na'\<rbrace>, X'\<rbrace> \<in> set evs3 \<longrightarrow> A = Aa \<and> nb = Nonce NB \<and> A = Aa \<and> B = Ba \<and> K = KAB \<and> na = Nonce NA \<and> X = Crypt (shrK Ba) \<lbrace>Agent Aa, Agent Ba, Key KAB, Nonce NB\<rbrace> \<longrightarrow> Aa = A' \<and> Ba = B' \<and> Nonce NA = na' \<and> Nonce NB = nb')
[PROOF STEP]
txt\<open>YM3, by freshness\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs3 KAB Ba NB Aa NA. \<lbrakk>evs3 \<in> yahalom; Says Server A' \<lbrace>nb', Crypt (shrK A') \<lbrace>Agent B', Key K, na'\<rbrace>, X'\<rbrace> \<in> set evs3 \<longrightarrow> Says Server A \<lbrace>nb, Crypt (shrK A) \<lbrace>Agent B, Key K, na\<rbrace>, X\<rbrace> \<in> set evs3 \<longrightarrow> A = A' \<and> B = B' \<and> na = na' \<and> nb = nb'; Key KAB \<notin> used evs3; Gets Server \<lbrace>Agent Ba, Nonce NB, Crypt (shrK Ba) \<lbrace>Agent Aa, Nonce NA\<rbrace>\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> (A' = Aa \<and> nb' = Nonce NB \<and> A' = Aa \<and> B' = Ba \<and> K = KAB \<and> na' = Nonce NA \<and> X' = Crypt (shrK Ba) \<lbrace>Agent Aa, Agent Ba, Key KAB, Nonce NB\<rbrace> \<longrightarrow> Says Server A \<lbrace>nb, Crypt (shrK A) \<lbrace>Agent B, Key KAB, na\<rbrace>, X\<rbrace> \<in> set evs3 \<longrightarrow> A = Aa \<and> B = Ba \<and> na = Nonce NA \<and> nb = Nonce NB) \<and> (Says Server A' \<lbrace>nb', Crypt (shrK A') \<lbrace>Agent B', Key K, na'\<rbrace>, X'\<rbrace> \<in> set evs3 \<longrightarrow> A = Aa \<and> nb = Nonce NB \<and> A = Aa \<and> B = Ba \<and> K = KAB \<and> na = Nonce NA \<and> X = Crypt (shrK Ba) \<lbrace>Agent Aa, Agent Ba, Key KAB, Nonce NB\<rbrace> \<longrightarrow> Aa = A' \<and> Ba = B' \<and> Nonce NA = na' \<and> Nonce NB = nb')
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done