[STATEMENT]
lemma servK_authentic_bis:
     "\<lbrakk> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>
           \<in> parts (spies evs);
         Key authK \<notin> analz (spies evs);
         B \<noteq> Tgs;
         evs \<in> kerbIV \<rbrakk>
 \<Longrightarrow> \<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>)
       \<in> set evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs); Key authK \<notin> analz (knows Spy evs); B \<noteq> Tgs; evs \<in> kerbIV\<rbrakk> \<Longrightarrow> \<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Key authK \<notin> analz (knows Spy evs); B \<noteq> Tgs; evs \<in> kerbIV\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs)
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>B \<noteq> Tgs; evs \<in> kerbIV\<rbrakk> \<Longrightarrow> Key authK \<notin> analz (knows Spy evs) \<longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs)
[PROOF STEP]
apply (erule kerbIV.induct, analz_mono_contra)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. B \<noteq> Tgs \<Longrightarrow> Key authK \<notin> analz (knows Spy []) \<longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy []) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set [])
 2. \<And>evsf X Ba. \<lbrakk>B \<noteq> Tgs; evsf \<in> kerbIV; X \<in> synth (analz (knows Spy evsf)); Key authK \<notin> analz (knows Spy evsf); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evsf)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Spy Ba X # evsf)) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says Spy Ba X # evsf))
 3. \<And>evs1 A. \<lbrakk>B \<noteq> Tgs; evs1 \<in> kerbIV; Key authK \<notin> analz (knows Spy evs1); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs1)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1))
 4. \<And>evs2 authKa A' A T1. \<lbrakk>B \<noteq> Tgs; evs2 \<in> kerbIV; Key authKa \<notin> used evs2; authKa \<in> symKeys; Says A' Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs2; Key authK \<notin> analz (knows Spy evs2); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs2)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Kas A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number (CT evs2), Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number (CT evs2)\<rbrace>\<rbrace>) # evs2)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says Kas A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number (CT evs2), Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number (CT evs2)\<rbrace>\<rbrace>) # evs2))
 5. \<And>evs3 A T1 Kas' authKa Ta authTicket Ba. \<lbrakk>B \<noteq> Tgs; evs3 \<in> kerbIV; Says A Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs3; Says Kas' A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evs3; valid Ta wrt T1; Key authK \<notin> analz (knows Spy evs3); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs3)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Tgs \<lbrace>authTicket, Crypt authKa \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent Ba\<rbrace> # evs3)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says A Tgs \<lbrace>authTicket, Crypt authKa \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent Ba\<rbrace> # evs3))
 6. \<And>evs4 servKa Ba authKa A' A Ta T2. \<lbrakk>B \<noteq> Tgs; evs4 \<in> kerbIV; Key servKa \<notin> used evs4; servKa \<in> symKeys; Ba \<noteq> Tgs; authKa \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number Ta\<rbrace>, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredAK Ta evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key authK \<notin> analz (knows Spy evs4); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs4)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Tgs A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace>\<rbrace>) # evs4)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says Tgs A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace>\<rbrace>) # evs4))
 7. \<And>evs5 authKa servKa A authTicket T2 Ba Tgs' Tsa servTicketa. \<lbrakk>B \<noteq> Tgs; evs5 \<in> kerbIV; authKa \<in> symKeys; servKa \<in> symKeys; Says A Tgs \<lbrace>authTicket, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs5; Says Tgs' A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number Tsa, servTicketa\<rbrace>) \<in> set evs5; valid Tsa wrt T2; Key authK \<notin> analz (knows Spy evs5); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs5) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs5)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Ba \<lbrace>servTicketa, Crypt servKa \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says A Ba \<lbrace>servTicketa, Crypt servKa \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5))
 8. \<And>evs6 A' Ba A servKa Tsa T3. \<lbrakk>B \<noteq> Tgs; evs6 \<in> kerbIV; Says A' Ba \<lbrace>Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number Tsa\<rbrace>, Crypt servKa \<lbrace>Agent A, Number T3\<rbrace>\<rbrace> \<in> set evs6; \<not> expiredSK Tsa evs6; \<not> expiredA T3 evs6; Key authK \<notin> analz (knows Spy evs6); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs6) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs6)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Ba A (Crypt servKa (Number T3)) # evs6)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says Ba A (Crypt servKa (Number T3)) # evs6))
 9. \<And>evsO1 A authKa Ta authTicket. \<lbrakk>B \<noteq> Tgs; evsO1 \<in> kerbIV; A \<noteq> Spy; Says Kas A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evsO1; expiredAK Ta evsO1; Key authK \<notin> analz (knows Spy evsO1); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evsO1) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evsO1)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authKa\<rbrace> # evsO1)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says A Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authKa\<rbrace> # evsO1))
 10. \<And>evsO2 A authKa servKa Ba Tsa servTicketa. \<lbrakk>B \<noteq> Tgs; evsO2 \<in> kerbIV; A \<noteq> Spy; Says Tgs A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number Tsa, servTicketa\<rbrace>) \<in> set evsO2; expiredSK Tsa evsO2; Key authK \<notin> analz (knows Spy evsO2); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evsO2) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evsO2)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Ba, Number Tsa, Key servKa\<rbrace> # evsO2)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says A Spy \<lbrace>Agent A, Agent Ba, Number Tsa, Key servKa\<rbrace> # evsO2))
[PROOF STEP]
apply (frule_tac [7] K5_msg_in_parts_spies)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. B \<noteq> Tgs \<Longrightarrow> Key authK \<notin> analz (knows Spy []) \<longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy []) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set [])
 2. \<And>evsf X Ba. \<lbrakk>B \<noteq> Tgs; evsf \<in> kerbIV; X \<in> synth (analz (knows Spy evsf)); Key authK \<notin> analz (knows Spy evsf); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evsf)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Spy Ba X # evsf)) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says Spy Ba X # evsf))
 3. \<And>evs1 A. \<lbrakk>B \<noteq> Tgs; evs1 \<in> kerbIV; Key authK \<notin> analz (knows Spy evs1); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs1)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1))
 4. \<And>evs2 authKa A' A T1. \<lbrakk>B \<noteq> Tgs; evs2 \<in> kerbIV; Key authKa \<notin> used evs2; authKa \<in> symKeys; Says A' Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs2; Key authK \<notin> analz (knows Spy evs2); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs2)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Kas A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number (CT evs2), Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number (CT evs2)\<rbrace>\<rbrace>) # evs2)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says Kas A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number (CT evs2), Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number (CT evs2)\<rbrace>\<rbrace>) # evs2))
 5. \<And>evs3 A T1 Kas' authKa Ta authTicket Ba. \<lbrakk>B \<noteq> Tgs; evs3 \<in> kerbIV; Says A Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs3; Says Kas' A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evs3; valid Ta wrt T1; Key authK \<notin> analz (knows Spy evs3); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs3)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Tgs \<lbrace>authTicket, Crypt authKa \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent Ba\<rbrace> # evs3)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says A Tgs \<lbrace>authTicket, Crypt authKa \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent Ba\<rbrace> # evs3))
 6. \<And>evs4 servKa Ba authKa A' A Ta T2. \<lbrakk>B \<noteq> Tgs; evs4 \<in> kerbIV; Key servKa \<notin> used evs4; servKa \<in> symKeys; Ba \<noteq> Tgs; authKa \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number Ta\<rbrace>, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredAK Ta evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key authK \<notin> analz (knows Spy evs4); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs4)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Tgs A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace>\<rbrace>) # evs4)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says Tgs A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace>\<rbrace>) # evs4))
 7. \<And>evs5 authKa servKa A authTicket T2 Ba Tgs' Tsa servTicketa. \<lbrakk>B \<noteq> Tgs; evs5 \<in> kerbIV; authKa \<in> symKeys; servKa \<in> symKeys; Says A Tgs \<lbrace>authTicket, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs5; Says Tgs' A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number Tsa, servTicketa\<rbrace>) \<in> set evs5; valid Tsa wrt T2; Key authK \<notin> analz (knows Spy evs5); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs5) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs5); servTicketa \<in> parts (knows Spy evs5)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Ba \<lbrace>servTicketa, Crypt servKa \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says A Ba \<lbrace>servTicketa, Crypt servKa \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5))
 8. \<And>evs6 A' Ba A servKa Tsa T3. \<lbrakk>B \<noteq> Tgs; evs6 \<in> kerbIV; Says A' Ba \<lbrace>Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number Tsa\<rbrace>, Crypt servKa \<lbrace>Agent A, Number T3\<rbrace>\<rbrace> \<in> set evs6; \<not> expiredSK Tsa evs6; \<not> expiredA T3 evs6; Key authK \<notin> analz (knows Spy evs6); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs6) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs6)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says Ba A (Crypt servKa (Number T3)) # evs6)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says Ba A (Crypt servKa (Number T3)) # evs6))
 9. \<And>evsO1 A authKa Ta authTicket. \<lbrakk>B \<noteq> Tgs; evsO1 \<in> kerbIV; A \<noteq> Spy; Says Kas A (Crypt (shrK A) \<lbrace>Key authKa, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evsO1; expiredAK Ta evsO1; Key authK \<notin> analz (knows Spy evsO1); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evsO1) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evsO1)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authKa\<rbrace> # evsO1)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says A Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authKa\<rbrace> # evsO1))
 10. \<And>evsO2 A authKa servKa Ba Tsa servTicketa. \<lbrakk>B \<noteq> Tgs; evsO2 \<in> kerbIV; A \<noteq> Spy; Says Tgs A (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number Tsa, servTicketa\<rbrace>) \<in> set evsO2; expiredSK Tsa evsO2; Key authK \<notin> analz (knows Spy evsO2); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evsO2) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evsO2)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Ba, Number Tsa, Key servKa\<rbrace> # evsO2)) \<longrightarrow> (\<exists>Aa. Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set (Says A Spy \<lbrace>Agent A, Agent Ba, Number Tsa, Key servKa\<rbrace> # evsO2))
[PROOF STEP]
apply (frule_tac [5] K3_msg_in_parts_spies, simp_all)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evsf X. \<lbrakk>B \<noteq> Tgs; evsf \<in> kerbIV; X \<in> synth (analz (knows Spy evsf)); Key authK \<notin> analz (knows Spy evsf); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evsf)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (insert X (knows Spy evsf)) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evsf)
 2. \<And>evs4 servKa Ba authKa A' A Ta T2. \<lbrakk>B \<noteq> Tgs; evs4 \<in> kerbIV; Key servKa \<notin> used evs4; servKa \<in> symKeys; Ba \<noteq> Tgs; authKa \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number Ta\<rbrace>, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key authK \<notin> analz (knows Spy evs4); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs4)\<rbrakk> \<Longrightarrow> (authK = authKa \<and> servK = servKa \<and> B = Ba \<and> Ts = CT evs4 \<and> servTicket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace> \<longrightarrow> (\<exists>Aa. Aa = A \<or> Says Tgs Aa (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace>\<rbrace>) \<in> set evs4)) \<and> (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> (\<exists>Aa. Aa = A \<and> authK = authKa \<and> servK = servKa \<and> B = Ba \<and> Ts = CT evs4 \<and> servTicket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace> \<or> Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs4))
[PROOF STEP]
txt\<open>Fake\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evsf X. \<lbrakk>B \<noteq> Tgs; evsf \<in> kerbIV; X \<in> synth (analz (knows Spy evsf)); Key authK \<notin> analz (knows Spy evsf); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evsf)\<rbrakk> \<Longrightarrow> Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (insert X (knows Spy evsf)) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evsf)
 2. \<And>evs4 servKa Ba authKa A' A Ta T2. \<lbrakk>B \<noteq> Tgs; evs4 \<in> kerbIV; Key servKa \<notin> used evs4; servKa \<in> symKeys; Ba \<noteq> Tgs; authKa \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number Ta\<rbrace>, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key authK \<notin> analz (knows Spy evs4); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs4)\<rbrakk> \<Longrightarrow> (authK = authKa \<and> servK = servKa \<and> B = Ba \<and> Ts = CT evs4 \<and> servTicket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace> \<longrightarrow> (\<exists>Aa. Aa = A \<or> Says Tgs Aa (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace>\<rbrace>) \<in> set evs4)) \<and> (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> (\<exists>Aa. Aa = A \<and> authK = authKa \<and> servK = servKa \<and> B = Ba \<and> Ts = CT evs4 \<and> servTicket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace> \<or> Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs4))
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs4 servKa Ba authKa A' A Ta T2. \<lbrakk>B \<noteq> Tgs; evs4 \<in> kerbIV; Key servKa \<notin> used evs4; servKa \<in> symKeys; Ba \<noteq> Tgs; authKa \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number Ta\<rbrace>, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key authK \<notin> analz (knows Spy evs4); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs4)\<rbrakk> \<Longrightarrow> (authK = authKa \<and> servK = servKa \<and> B = Ba \<and> Ts = CT evs4 \<and> servTicket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace> \<longrightarrow> (\<exists>Aa. Aa = A \<or> Says Tgs Aa (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace>\<rbrace>) \<in> set evs4)) \<and> (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> (\<exists>Aa. Aa = A \<and> authK = authKa \<and> servK = servKa \<and> B = Ba \<and> Ts = CT evs4 \<and> servTicket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace> \<or> Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs4))
[PROOF STEP]
txt\<open>K4\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs4 servKa Ba authKa A' A Ta T2. \<lbrakk>B \<noteq> Tgs; evs4 \<in> kerbIV; Key servKa \<notin> used evs4; servKa \<in> symKeys; Ba \<noteq> Tgs; authKa \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authKa, Number Ta\<rbrace>, Crypt authKa \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key authK \<notin> analz (knows Spy evs4); Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> (\<exists>A. Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs4)\<rbrakk> \<Longrightarrow> (authK = authKa \<and> servK = servKa \<and> B = Ba \<and> Ts = CT evs4 \<and> servTicket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace> \<longrightarrow> (\<exists>Aa. Aa = A \<or> Says Tgs Aa (Crypt authKa \<lbrace>Key servKa, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace>\<rbrace>) \<in> set evs4)) \<and> (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> (\<exists>Aa. Aa = A \<and> authK = authKa \<and> servK = servKa \<and> B = Ba \<and> Ts = CT evs4 \<and> servTicket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servKa, Number (CT evs4)\<rbrace> \<or> Says Tgs Aa (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs4))
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma exists_next_propagate':
  assumes "c_work c loc \<noteq> {#}\<^sub>z"
  shows   "\<exists>c' loc t. next_propagate' c c' loc t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>c'. next_propagate c c'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c'. next_propagate c c'
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
c_work c loc \<noteq> {#}\<^sub>z
[PROOF STEP]
obtain loc' t where loc't:
    "t \<in>#\<^sub>z c_work c loc'"
    "\<forall>t' loc'. t' \<in>#\<^sub>z c_work c loc' \<longrightarrow> \<not> t' < t"
[PROOF STATE]
proof (prove)
using this:
c_work c loc \<noteq> {#}\<^sub>z

goal (1 subgoal):
 1. (\<And>t loc'. \<lbrakk>t \<in>#\<^sub>z c_work c loc'; \<forall>t' loc'. t' \<in>#\<^sub>z c_work c loc' \<longrightarrow> \<not> t' < t\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (rule obtain_min_worklist)
[PROOF STATE]
proof (state)
this:
t \<in>#\<^sub>z c_work c loc'
\<forall>t' loc'. t' \<in>#\<^sub>z c_work c loc' \<longrightarrow> \<not> t' < t

goal (1 subgoal):
 1. \<exists>c'. next_propagate c c'
[PROOF STEP]
let ?imps = "\<lambda>locX. if locX = loc' then c_imp c locX + {#t' \<in>#\<^sub>z c_work c locX. t' = t#}
                                     else c_imp c locX"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c'. next_propagate c c'
[PROOF STEP]
let ?wl = "\<lambda>locX. if locX = loc' then {#t' \<in>#\<^sub>z c_work c locX. t' \<noteq> t#}
                    else c_work c locX
                           + after_summary
                               (frontier_changes (?imps loc') (c_imp c loc'))
                               (summary loc' locX)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c'. next_propagate c c'
[PROOF STEP]
let ?c = "c\<lparr>c_imp := ?imps, c_work := ?wl\<rparr>"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c'. next_propagate c c'
[PROOF STEP]
from loc't assms
[PROOF STATE]
proof (chain)
picking this:
t \<in>#\<^sub>z c_work c loc'
\<forall>t' loc'. t' \<in>#\<^sub>z c_work c loc' \<longrightarrow> \<not> t' < t
c_work c loc \<noteq> {#}\<^sub>z
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
t \<in>#\<^sub>z c_work c loc'
\<forall>t' loc'. t' \<in>#\<^sub>z c_work c loc' \<longrightarrow> \<not> t' < t
c_work c loc \<noteq> {#}\<^sub>z

goal (1 subgoal):
 1. \<exists>c'. next_propagate c c'
[PROOF STEP]
by (intro exI[of _ ?c] exI[of _ loc'] exI[of _ t])
      (auto simp: next_propagate'_def intro!: Propagate.configuration.equality)
[PROOF STATE]
proof (state)
this:
\<exists>c'. next_propagate c c'

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma length_trace_parallel_plan_sas_plus_lte_length_plan_plus_one:
  shows "length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1
[PROOF STEP]
proof (induction \<psi> arbitrary: I)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>I. length (trace_parallel_plan_sas_plus I []) \<le> length [] + 1
 2. \<And>a \<psi> I. (\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1) \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
case (Cons a \<psi>)
[PROOF STATE]
proof (state)
this:
length (trace_parallel_plan_sas_plus ?I \<psi>) \<le> length \<psi> + 1

goal (2 subgoals):
 1. \<And>I. length (trace_parallel_plan_sas_plus I []) \<le> length [] + 1
 2. \<And>a \<psi> I. (\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1) \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
length (trace_parallel_plan_sas_plus ?I \<psi>) \<le> length \<psi> + 1
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
length (trace_parallel_plan_sas_plus ?I \<psi>) \<le> length \<psi> + 1

goal (1 subgoal):
 1. length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
proof (cases "are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
 2. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; \<not> (are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a)\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a

goal (2 subgoals):
 1. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
 2. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; \<not> (are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a)\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
let ?I' = "execute_parallel_operator_sas_plus I a"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
 2. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; \<not> (are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a)\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
 2. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; \<not> (are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a)\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
have "trace_parallel_plan_sas_plus I (a # \<psi>) = I # trace_parallel_plan_sas_plus ?I' \<psi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. trace_parallel_plan_sas_plus I (a # \<psi>) = I # trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>
[PROOF STEP]
using True
[PROOF STATE]
proof (prove)
using this:
are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a

goal (1 subgoal):
 1. trace_parallel_plan_sas_plus I (a # \<psi>) = I # trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
trace_parallel_plan_sas_plus I (a # \<psi>) = I # trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>

goal (2 subgoals):
 1. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
 2. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; \<not> (are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a)\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
trace_parallel_plan_sas_plus I (a # \<psi>) = I # trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>
[PROOF STEP]
have "length (trace_parallel_plan_sas_plus I (a # \<psi>))
          = length (trace_parallel_plan_sas_plus ?I' \<psi>) + 1"
[PROOF STATE]
proof (prove)
using this:
trace_parallel_plan_sas_plus I (a # \<psi>) = I # trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>

goal (1 subgoal):
 1. length (trace_parallel_plan_sas_plus I (a # \<psi>)) = length (trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>) + 1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
length (trace_parallel_plan_sas_plus I (a # \<psi>)) = length (trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>) + 1

goal (2 subgoals):
 1. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
 2. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; \<not> (are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a)\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length (trace_parallel_plan_sas_plus I (a # \<psi>)) = length (trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>) + 1

goal (2 subgoals):
 1. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
 2. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; \<not> (are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a)\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
have "length (trace_parallel_plan_sas_plus ?I' \<psi>) \<le> length \<psi> + 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>) \<le> length \<psi> + 1
[PROOF STEP]
using Cons.IH[of ?I']
[PROOF STATE]
proof (prove)
using this:
length (trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>) \<le> length \<psi> + 1

goal (1 subgoal):
 1. length (trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>) \<le> length \<psi> + 1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
length (trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>) \<le> length \<psi> + 1

goal (2 subgoals):
 1. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
 2. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; \<not> (are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a)\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
length (trace_parallel_plan_sas_plus I (a # \<psi>)) = length (trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>) + 1
length (trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>) \<le> length \<psi> + 1
[PROOF STEP]
have "length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1"
[PROOF STATE]
proof (prove)
using this:
length (trace_parallel_plan_sas_plus I (a # \<psi>)) = length (trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>) + 1
length (trace_parallel_plan_sas_plus (execute_parallel_operator_sas_plus I a) \<psi>) \<le> length \<psi> + 1

goal (1 subgoal):
 1. length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1

goal (2 subgoals):
 1. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
 2. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; \<not> (are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a)\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1

goal (2 subgoals):
 1. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
 2. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; \<not> (are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a)\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1

goal (1 subgoal):
 1. length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1

goal (1 subgoal):
 1. \<lbrakk>\<And>I. length (trace_parallel_plan_sas_plus I \<psi>) \<le> length \<psi> + 1; \<not> (are_all_operators_applicable_in I a \<and> are_all_operator_effects_consistent a)\<rbrakk> \<Longrightarrow> length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1
[PROOF STEP]
qed auto
[PROOF STATE]
proof (state)
this:
length (trace_parallel_plan_sas_plus I (a # \<psi>)) \<le> length (a # \<psi>) + 1

goal (1 subgoal):
 1. \<And>I. length (trace_parallel_plan_sas_plus I []) \<le> length [] + 1
[PROOF STEP]
qed simp