[STATEMENT]
lemma reachable_constraints_no_Pair_fun':
  assumes A: "A \<in> reachable_constraints P"
    and P: "\<forall>T \<in> set P. \<forall>x \<in> set (transaction_fresh T). \<Gamma>\<^sub>v x = TAtom Value"
           "\<forall>T \<in> set P. transaction_decl T () = []"
           "\<forall>T \<in> set P. admissible_transaction_terms T"
           "\<forall>T \<in> set P. \<forall>x \<in> vars_transaction T. \<Gamma>\<^sub>v x = TAtom Value \<or> (\<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a)"
  shows "Pair \<notin> \<Union>(funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A))
[PROOF STEP]
using A
[PROOF STATE]
proof (prove)
using this:
A \<in> reachable_constraints P

goal (1 subgoal):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A))
[PROOF STEP]
proof (induction A rule: reachable_constraints.induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
case (step A T \<xi> \<sigma> \<alpha>)
[PROOF STATE]
proof (state)
this:
A \<in> reachable_constraints P
T \<in> set P
transaction_decl_subst \<xi> T
transaction_fresh_subst \<sigma> T A
transaction_renaming_subst \<alpha> P A
prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A))

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
define T' where "T' \<equiv> dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)"
[PROOF STATE]
proof (state)
this:
T' \<equiv> dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
note T_fresh_type = bspec[OF P(1) step.hyps(2)]
[PROOF STATE]
proof (state)
this:
\<forall>x\<in>set (transaction_fresh T). \<Gamma>\<^sub>v x = Var Value

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
note \<xi>_empty =
    admissible_transaction_decl_subst_empty'[OF bspec[OF P(2) step.hyps(2)] step.hyps(3)]
[PROOF STATE]
proof (state)
this:
\<xi> = Var

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
note T_adm_terms = bspec[OF P(3) step.hyps(2)]
[PROOF STATE]
proof (state)
this:
admissible_transaction_terms T

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
note \<xi>\<sigma>\<alpha>_wt = transaction_decl_fresh_renaming_substs_wt[OF step.hyps(3-5)]
[PROOF STATE]
proof (state)
this:
wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
note \<xi>\<sigma>\<alpha>_wf = transaction_decl_fresh_renaming_substs_range_wf_trms[OF step.hyps(3-5)]
[PROOF STATE]
proof (state)
this:
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
have 0: "SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A@T')) = SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A) \<union> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A @ T')) = SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A) \<union> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')
[PROOF STEP]
using SMP_union[of "trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A" "trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T'"]
          unlabel_append[of A T'] trms\<^sub>s\<^sub>s\<^sub>t_append[of "unlabel A" "unlabel T'"]
[PROOF STATE]
proof (prove)
using this:
SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') = SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A) \<union> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')
unlabel (A @ T') = unlabel A @ unlabel T'
trms\<^sub>s\<^sub>s\<^sub>t (unlabel A @ unlabel T') = trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T'

goal (1 subgoal):
 1. SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A @ T')) = SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A) \<union> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A @ T')) = SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A) \<union> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
have 1: "wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')
[PROOF STEP]
using reachable_constraints_wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s[OF _ reachable_constraints.step[OF step.hyps]]
          admissible_transaction_terms_wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s P(3)
          trms\<^sub>s\<^sub>s\<^sub>t_append[of "unlabel A"] unlabel_append[of A]
[PROOF STATE]
proof (prove)
using this:
\<forall>T\<in>set P. wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms_transaction T) \<Longrightarrow> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)))
admissible_transaction_terms ?T \<Longrightarrow> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms_transaction ?T)
Ball (set P) admissible_transaction_terms
trms\<^sub>s\<^sub>s\<^sub>t (unlabel A @ ?B) = trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> trms\<^sub>s\<^sub>s\<^sub>t ?B
unlabel (A @ ?B) = unlabel A @ unlabel ?B

goal (1 subgoal):
 1. wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')
[PROOF STEP]
unfolding T'_def
[PROOF STATE]
proof (prove)
using this:
\<forall>T\<in>set P. wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms_transaction T) \<Longrightarrow> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)))
admissible_transaction_terms ?T \<Longrightarrow> wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms_transaction ?T)
Ball (set P) admissible_transaction_terms
trms\<^sub>s\<^sub>s\<^sub>t (unlabel A @ ?B) = trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> trms\<^sub>s\<^sub>s\<^sub>t ?B
unlabel (A @ ?B) = unlabel A @ unlabel ?B

goal (1 subgoal):
 1. wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
have 2: "Pair \<notin> \<Union>(funs_term ` (subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))
[PROOF STEP]
using transaction_decl_fresh_renaming_substs_range'(3)[
            OF step.hyps(3-5) _ \<xi>_empty T_fresh_type]
[PROOF STATE]
proof (prove)
using this:
?t \<in> subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \<Longrightarrow> (\<exists>n. ?t = Fun (Val n) []) \<or> (\<exists>x. ?t = Var x)

goal (1 subgoal):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
prot_fun.Pair \<notin> \<Union> (funs_term ` subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
have "Pair \<notin> \<Union>(funs_term ` (trms_transaction T))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` trms_transaction T)
[PROOF STEP]
using T_adm_terms
[PROOF STATE]
proof (prove)
using this:
admissible_transaction_terms T

goal (1 subgoal):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` trms_transaction T)
[PROOF STEP]
unfolding admissible_transaction_terms_def
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s' arity (trms_transaction T) \<and> (\<forall>f\<in>\<Union> (funs_term ` trms_transaction T). \<not> is_Val f \<and> \<not> is_Abs f \<and> \<not> is_PubConst f \<and> f \<noteq> prot_fun.Pair) \<and> (\<forall>r\<in>set (unlabel (transaction_strand T)). (\<exists>f\<in>\<Union> (funs_term ` trms\<^sub>s\<^sub>s\<^sub>t\<^sub>p r). is_Attack f) \<longrightarrow> stateful_strand_step.is_Send r \<and> length (the_msgs r) = 1 \<and> is_Fun_Attack (hd (the_msgs r)))

goal (1 subgoal):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` trms_transaction T)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
prot_fun.Pair \<notin> \<Union> (funs_term ` trms_transaction T)

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
hence "Pair \<notin> funs_term t"
    when t: "t \<in> trms\<^sub>s\<^sub>s\<^sub>t (unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)" for t
[PROOF STATE]
proof (prove)
using this:
prot_fun.Pair \<notin> \<Union> (funs_term ` trms_transaction T)

goal (1 subgoal):
 1. prot_fun.Pair \<notin> funs_term t
[PROOF STEP]
using 2 trms\<^sub>s\<^sub>s\<^sub>t_funs_term_cases[OF t]
[PROOF STATE]
proof (prove)
using this:
prot_fun.Pair \<notin> \<Union> (funs_term ` trms_transaction T)
prot_fun.Pair \<notin> \<Union> (funs_term ` subst_range (\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))
?f \<in> funs_term t \<Longrightarrow> (\<exists>u\<in>trms_transaction T. ?f \<in> funs_term u) \<or> (\<exists>x\<in>fv_transaction T. ?f \<in> funs_term ((\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) x))

goal (1 subgoal):
 1. prot_fun.Pair \<notin> funs_term t
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
?t24 \<in> trms\<^sub>s\<^sub>s\<^sub>t (unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \<Longrightarrow> prot_fun.Pair \<notin> funs_term ?t24

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
hence 3: "Pair \<notin> funs_term t" when t: "t \<in> trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T'" for t
[PROOF STATE]
proof (prove)
using this:
?t24 \<in> trms\<^sub>s\<^sub>s\<^sub>t (unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \<Longrightarrow> prot_fun.Pair \<notin> funs_term ?t24

goal (1 subgoal):
 1. prot_fun.Pair \<notin> funs_term t
[PROOF STEP]
using t unlabel_subst[of "transaction_strand T" "\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>"]
          trms\<^sub>s\<^sub>s\<^sub>t_unlabel_dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t_eq[of "transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>"]
[PROOF STATE]
proof (prove)
using this:
?t24 \<in> trms\<^sub>s\<^sub>s\<^sub>t (unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \<Longrightarrow> prot_fun.Pair \<notin> funs_term ?t24
t \<in> trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T'
unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha> = unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)
trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) = trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)

goal (1 subgoal):
 1. prot_fun.Pair \<notin> funs_term t
[PROOF STEP]
unfolding T'_def
[PROOF STATE]
proof (prove)
using this:
?t24 \<in> trms\<^sub>s\<^sub>s\<^sub>t (unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \<Longrightarrow> prot_fun.Pair \<notin> funs_term ?t24
t \<in> trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))
unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha> = unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)
trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) = trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)

goal (1 subgoal):
 1. prot_fun.Pair \<notin> funs_term t
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
?t24 \<in> trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T' \<Longrightarrow> prot_fun.Pair \<notin> funs_term ?t24

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
have "\<exists>a. \<Gamma>\<^sub>v x = TAtom a" when "x \<in> vars_transaction T" for x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = Var a
[PROOF STEP]
using that protocol_transaction_vars_TAtom_typed(1) bspec[OF P(4) step.hyps(2)]
[PROOF STATE]
proof (prove)
using this:
x \<in> vars_transaction T
admissible_transaction ?T \<Longrightarrow> \<forall>x\<in>vars_transaction ?T. \<Gamma>\<^sub>v x = Var Value \<or> (\<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a)
\<forall>x\<in>vars_transaction T. \<Gamma>\<^sub>v x = Var Value \<or> (\<exists>a. \<Gamma>\<^sub>v x = \<langle>a\<rangle>\<^sub>\<tau>\<^sub>a)

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = Var a
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
?x24 \<in> vars_transaction T \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
hence "\<exists>a. \<Gamma>\<^sub>v x = TAtom a" when "x \<in> vars\<^sub>s\<^sub>s\<^sub>t (unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)" for x
[PROOF STATE]
proof (prove)
using this:
?x24 \<in> vars_transaction T \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = Var a
[PROOF STEP]
using wt_subst_fv\<^sub>s\<^sub>e\<^sub>t_termtype_subterm[OF _ \<xi>\<sigma>\<alpha>_wt \<xi>\<sigma>\<alpha>_wf, of x "vars_transaction T"]
          vars\<^sub>s\<^sub>s\<^sub>t_subst_cases[OF that]
[PROOF STATE]
proof (prove)
using this:
?x24 \<in> vars_transaction T \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a
x \<in> fv\<^sub>s\<^sub>e\<^sub>t ((\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) ` vars_transaction T) \<Longrightarrow> \<exists>y\<in>vars_transaction T. \<Gamma> (Var x) \<sqsubseteq> \<Gamma> (Var y)
x \<in> vars_transaction T \<or> x \<in> fv\<^sub>s\<^sub>e\<^sub>t ((\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) ` vars_transaction T)

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = Var a
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
?x24 \<in> vars\<^sub>s\<^sub>s\<^sub>t (unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
hence "\<exists>a. \<Gamma>\<^sub>v x = TAtom a" when "x \<in> vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t T'" for x
[PROOF STATE]
proof (prove)
using this:
?x24 \<in> vars\<^sub>s\<^sub>s\<^sub>t (unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = Var a
[PROOF STEP]
using that unlabel_subst[of "transaction_strand T" "\<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>"]
          vars\<^sub>s\<^sub>s\<^sub>t_unlabel_dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t_eq[of "transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>"]
[PROOF STATE]
proof (prove)
using this:
?x24 \<in> vars\<^sub>s\<^sub>s\<^sub>t (unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a
x \<in> vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t T'
unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha> = unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)
vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) = vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = Var a
[PROOF STEP]
unfolding T'_def
[PROOF STATE]
proof (prove)
using this:
?x24 \<in> vars\<^sub>s\<^sub>s\<^sub>t (unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>) \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a
x \<in> vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))
unlabel (transaction_strand T) \<cdot>\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha> = unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)
vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)) = vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = Var a
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
?x24 \<in> vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t T' \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
hence "\<exists>a. \<Gamma>\<^sub>v x = TAtom a" when "x \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')" for x
[PROOF STATE]
proof (prove)
using this:
?x24 \<in> vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t T' \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = Var a
[PROOF STEP]
using that fv_trms\<^sub>s\<^sub>s\<^sub>t_subset(1)
[PROOF STATE]
proof (prove)
using this:
?x24 \<in> vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t T' \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a
x \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')
fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>s\<^sub>s\<^sub>t ?S) \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t ?S

goal (1 subgoal):
 1. \<exists>a. \<Gamma>\<^sub>v x = Var a
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
?x24 \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
hence "Pair \<notin> funs_term (\<Gamma> (Var x))" when "x \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')" for x
[PROOF STATE]
proof (prove)
using this:
?x24 \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a

goal (1 subgoal):
 1. prot_fun.Pair \<notin> funs_term (\<Gamma> (Var x))
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
?x24 \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<Longrightarrow> \<exists>a. \<Gamma>\<^sub>v ?x24 = Var a
x \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')

goal (1 subgoal):
 1. prot_fun.Pair \<notin> funs_term (\<Gamma> (Var x))
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
?x24 \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<Longrightarrow> prot_fun.Pair \<notin> funs_term (\<Gamma> (Var ?x24))

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
?x24 \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<Longrightarrow> prot_fun.Pair \<notin> funs_term (\<Gamma> (Var ?x24))

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
have "Pair \<in> funs_term s"
    when s: "Ana s = (K, M)" "Pair \<in> \<Union>(funs_term ` set K)"
    for s::"('fun,'atom,'sets,'lbl) prot_term" and K M
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prot_fun.Pair \<in> funs_term s
[PROOF STEP]
proof (cases s)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1. s = Var x1 \<Longrightarrow> prot_fun.Pair \<in> funs_term s
 2. \<And>x21 x22. s = Fun x21 x22 \<Longrightarrow> prot_fun.Pair \<in> funs_term s
[PROOF STEP]
case (Fun f S)
[PROOF STATE]
proof (state)
this:
s = Fun f S

goal (2 subgoals):
 1. \<And>x1. s = Var x1 \<Longrightarrow> prot_fun.Pair \<in> funs_term s
 2. \<And>x21 x22. s = Fun x21 x22 \<Longrightarrow> prot_fun.Pair \<in> funs_term s
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
s = Fun f S

goal (1 subgoal):
 1. prot_fun.Pair \<in> funs_term s
[PROOF STEP]
using s Ana_Fu_keys_not_pairs[of _ S K M]
[PROOF STATE]
proof (prove)
using this:
s = Fun f S
Ana s = (K, M)
prot_fun.Pair \<in> \<Union> (funs_term ` set K)
\<lbrakk>Ana \<langle>?f S\<rangle>\<^sub>t = (K, M); Ana\<^sub>f ?f = (?K', ?T'); ?k \<in> set K; \<forall>g\<in>funs_term \<langle>?f S\<rangle>\<^sub>t. g \<noteq> prot_fun.Pair\<rbrakk> \<Longrightarrow> \<forall>g\<in>funs_term ?k. g \<noteq> prot_fun.Pair

goal (1 subgoal):
 1. prot_fun.Pair \<in> funs_term s
[PROOF STEP]
by (cases f) force+
[PROOF STATE]
proof (state)
this:
prot_fun.Pair \<in> funs_term s

goal (1 subgoal):
 1. \<And>x1. s = Var x1 \<Longrightarrow> prot_fun.Pair \<in> funs_term s
[PROOF STEP]
qed (use s in simp)
[PROOF STATE]
proof (state)
this:
\<lbrakk>Ana ?s24 = (?K24, ?M24); prot_fun.Pair \<in> \<Union> (funs_term ` set ?K24)\<rbrakk> \<Longrightarrow> prot_fun.Pair \<in> funs_term ?s24

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
?x24 \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<Longrightarrow> prot_fun.Pair \<notin> funs_term (\<Gamma> (Var ?x24))
\<lbrakk>Ana ?s24 = (?K24, ?M24); prot_fun.Pair \<in> \<Union> (funs_term ` set ?K24)\<rbrakk> \<Longrightarrow> prot_fun.Pair \<in> funs_term ?s24
[PROOF STEP]
have "Pair \<notin> funs_term t" when t: "t \<in> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')" for t
[PROOF STATE]
proof (prove)
using this:
?x24 \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<Longrightarrow> prot_fun.Pair \<notin> funs_term (\<Gamma> (Var ?x24))
\<lbrakk>Ana ?s24 = (?K24, ?M24); prot_fun.Pair \<in> \<Union> (funs_term ` set ?K24)\<rbrakk> \<Longrightarrow> prot_fun.Pair \<in> funs_term ?s24

goal (1 subgoal):
 1. prot_fun.Pair \<notin> funs_term t
[PROOF STEP]
using t 3 SMP_funs_term[OF t _ _ 1, of Pair] funs_term_type_iff
[PROOF STATE]
proof (prove)
using this:
?x24 \<in> fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<Longrightarrow> prot_fun.Pair \<notin> funs_term (\<Gamma> (Var ?x24))
\<lbrakk>Ana ?s24 = (?K24, ?M24); prot_fun.Pair \<in> \<Union> (funs_term ` set ?K24)\<rbrakk> \<Longrightarrow> prot_fun.Pair \<in> funs_term ?s24
t \<in> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')
?t24 \<in> trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T' \<Longrightarrow> prot_fun.Pair \<notin> funs_term ?t24
\<lbrakk>prot_fun.Pair \<in> funs_term t \<or> (\<exists>x\<in>fv t. prot_fun.Pair \<in> funs_term (\<Gamma> (Var x))); 0 < arity prot_fun.Pair; \<And>s K T. \<lbrakk>Ana s = (K, T); prot_fun.Pair \<in> \<Union> (funs_term ` set K)\<rbrakk> \<Longrightarrow> prot_fun.Pair \<in> funs_term s\<rbrakk> \<Longrightarrow> prot_fun.Pair \<in> \<Union> (funs_term ` trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<or> (\<exists>x\<in>fv\<^sub>s\<^sub>e\<^sub>t (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T'). prot_fun.Pair \<in> funs_term (\<Gamma> (Var x)))
\<lbrakk>wf\<^sub>t\<^sub>r\<^sub>m ?t; 0 < arity ?f\<rbrakk> \<Longrightarrow> (?f \<in> funs_term (\<Gamma> ?t)) = (?f \<in> funs_term ?t \<or> (\<exists>x\<in>fv ?t. ?f \<in> funs_term (\<Gamma> (Var x))))

goal (1 subgoal):
 1. prot_fun.Pair \<notin> funs_term t
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
?t24 \<in> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<Longrightarrow> prot_fun.Pair \<notin> funs_term ?t24

goal (2 subgoals):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
 2. \<And>\<A> T \<xi> \<sigma> \<alpha>. \<lbrakk>\<A> \<in> reachable_constraints P; prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<A>)); T \<in> set P; transaction_decl_subst \<xi> T; transaction_fresh_subst \<sigma> T \<A>; transaction_renaming_subst \<alpha> P \<A>\<rbrakk> \<Longrightarrow> prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (\<A> @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
?t24 \<in> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<Longrightarrow> prot_fun.Pair \<notin> funs_term ?t24

goal (1 subgoal):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
using 0 step.IH(1)
[PROOF STATE]
proof (prove)
using this:
?t24 \<in> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T') \<Longrightarrow> prot_fun.Pair \<notin> funs_term ?t24
SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A @ T')) = SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A) \<union> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t T')
prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A))

goal (1 subgoal):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
unfolding T'_def
[PROOF STATE]
proof (prove)
using this:
?t24 \<in> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))) \<Longrightarrow> prot_fun.Pair \<notin> funs_term ?t24
SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))) = SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A) \<union> SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>)))
prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A))

goal (1 subgoal):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (A @ dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<xi> \<circ>\<^sub>s \<sigma> \<circ>\<^sub>s \<alpha>))))

goal (1 subgoal):
 1. prot_fun.Pair \<notin> \<Union> (funs_term ` SMP (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t []))
[PROOF STEP]
qed simp


[STATEMENT]
lemma hf_valid_invert:
  "hf_valid tsn uinfo hfs hf \<longleftrightarrow>
(\<exists> PoC_i_expire ahi A_i . tsn = Num PoC_i_expire \<and> ahi = AHI hf \<and>
UHI hf = () \<and> uinfo = \<epsilon> \<and>
HVF hf = A_i \<and>
A_i = Hash (maccontents ahi hfs PoC_i_expire))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. hf_valid tsn uinfo hfs hf = (\<exists>PoC_i_expire ahi A_i. tsn = Num PoC_i_expire \<and> ahi = AHI hf \<and> UHI hf = () \<and> uinfo = \<epsilon> \<and> HVF hf = A_i \<and> A_i = Hash (maccontents ahi hfs PoC_i_expire))
[PROOF STEP]
apply(cases hf)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>AHIa UHIa HVFa. hf = \<lparr>AHI = AHIa, UHI = UHIa, HVF = HVFa\<rparr> \<Longrightarrow> hf_valid tsn uinfo hfs hf = (\<exists>PoC_i_expire ahi A_i. tsn = Num PoC_i_expire \<and> ahi = AHI hf \<and> UHI hf = () \<and> uinfo = \<epsilon> \<and> HVF hf = A_i \<and> A_i = Hash (maccontents ahi hfs PoC_i_expire))
[PROOF STEP]
by(auto elim!: hf_valid.elims)