[STATEMENT]
lemma "P (case x of Nil \<Rightarrow> nil | Cons a b \<Rightarrow> cons a b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (case x of [] \<Rightarrow> nil | a # b \<Rightarrow> cons a b)
[PROOF STEP]
refute [expect = potential]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (case x of [] \<Rightarrow> nil | a # b \<Rightarrow> cons a b)
[PROOF STEP]
oops


[STATEMENT]
lemma (in mut_m) handshake_invL_eq_imp:
  "eq_imp (\<lambda>(_::unit) s. (AT s (mutator m), s\<down> (mutator m), sys_hs_type s\<down>, sys_hs_pending m s\<down>, mem_store_buffers (s\<down> sys) (mutator m)))
          handshake_invL"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eq_imp (\<lambda>_ s. (AT s (mutator m), s\<down> (mutator m), sys_hs_type s\<down>, sys_hs_pending m s\<down>, sys_mem_store_buffers (mutator m) s\<down>)) handshake_invL
[PROOF STEP]
unfolding eq_imp_def handshake_invL_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>s s'. (\<forall>x. (AT s (mutator m), s\<down> (mutator m), sys_hs_type s\<down>, sys_hs_pending m s\<down>, sys_mem_store_buffers (mutator m) s\<down>) = (AT s' (mutator m), s'\<down> (mutator m), sys_hs_type s'\<down>, sys_hs_pending m s'\<down>, sys_mem_store_buffers (mutator m) s'\<down>)) \<longrightarrow> ((atS (mutator m) hs_noop_locs s \<longrightarrow> sys_hs_type s\<down> = ht_NOOP) \<and> (atS (mutator m) hs_get_roots_locs s \<longrightarrow> sys_hs_type s\<down> = ht_GetRoots) \<and> (atS (mutator m) hs_get_work_locs s \<longrightarrow> sys_hs_type s\<down> = ht_GetWork) \<and> (atS (mutator m) ht_loaded_locs s \<longrightarrow> mut_hs_pending s\<down> \<longrightarrow> mut_hs_type s\<down> = sys_hs_type s\<down>) \<and> (atS (mutator m) hs_pending_loaded_locs s \<longrightarrow> mut_hs_pending s\<down> \<longrightarrow> sys_hs_pending m s\<down>) \<and> (atS (mutator m) hs_pending_locs s \<longrightarrow> mut_hs_pending s\<down>) \<and> (atS (mutator m) no_pending_mutations_locs s \<longrightarrow> filter (\<lambda>s. is_mw_Mutate s \<or> is_mw_Mutate_Payload s) (sys_mem_store_buffers (mutator m) s\<down>) = [])) = ((atS (mutator m) hs_noop_locs s' \<longrightarrow> sys_hs_type s'\<down> = ht_NOOP) \<and> (atS (mutator m) hs_get_roots_locs s' \<longrightarrow> sys_hs_type s'\<down> = ht_GetRoots) \<and> (atS (mutator m) hs_get_work_locs s' \<longrightarrow> sys_hs_type s'\<down> = ht_GetWork) \<and> (atS (mutator m) ht_loaded_locs s' \<longrightarrow> mut_hs_pending s'\<down> \<longrightarrow> mut_hs_type s'\<down> = sys_hs_type s'\<down>) \<and> (atS (mutator m) hs_pending_loaded_locs s' \<longrightarrow> mut_hs_pending s'\<down> \<longrightarrow> sys_hs_pending m s'\<down>) \<and> (atS (mutator m) hs_pending_locs s' \<longrightarrow> mut_hs_pending s'\<down>) \<and> (atS (mutator m) no_pending_mutations_locs s' \<longrightarrow> filter (\<lambda>s. is_mw_Mutate s \<or> is_mw_Mutate_Payload s) (sys_mem_store_buffers (mutator m) s'\<down>) = []))
[PROOF STEP]
by simp


[STATEMENT]
lemma interfree_Color_Target_Propagate_Black:
  "interfree_aux (Some Color_Target, {}, Some Propagate_Black)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. interfree_aux (Some Color_Target, {}, Some Propagate_Black)
[PROOF STEP]
apply (unfold modules )
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. interfree_aux (Some (\<lbrace>\<acute>Mut_init \<and> \<not> \<acute>z\<rbrace>
\<langle>\<acute>M := \<acute>M[T := Black],, \<acute>z := (\<not> \<acute>z)\<rangle>), {}, Some (\<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M\<rbrace> \<acute>ind := 0;; \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>ind = 0\<rbrace>
WHILE \<acute>ind < length \<acute>E INV \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>PBInv \<acute>ind \<and> \<acute>ind \<le> length \<acute>E\<rbrace>
DO \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>PBInv \<acute>ind \<and> \<acute>ind < length \<acute>E\<rbrace>
IF \<acute>M ! fst (\<acute>E ! \<acute>ind) = Black THEN \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>PBInv \<acute>ind \<and> \<acute>ind < length \<acute>E \<and> \<acute>M ! fst (\<acute>E ! \<acute>ind) = Black\<rbrace> \<acute>k := snd (\<acute>E ! \<acute>ind);; \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>PBInv \<acute>ind \<and> \<acute>ind < length \<acute>E \<and> \<acute>M ! fst (\<acute>E ! \<acute>ind) = Black \<and> \<acute>Auxk\<rbrace>
\<langle>\<acute>M := \<acute>M[\<acute>k := Black],, \<acute>ind := \<acute>ind + 1\<rangle> ELSE \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>PBInv \<acute>ind \<and> \<acute>ind < length \<acute>E\<rbrace>
\<langle>IF \<acute>M ! fst (\<acute>E ! \<acute>ind) \<noteq> Black THEN \<acute>ind := \<acute>ind + 1 FI\<rangle> FI
OD))
[PROOF STEP]
apply interfree_aux
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<lbrace>\<acute>Mut_init \<and> \<not> \<acute>z\<rbrace> \<inter> \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M\<rbrace> \<subseteq> \<lbrace>\<acute>(ind_update (\<lambda>_. 0)) \<in> \<lbrace>\<acute>Mut_init \<and> \<not> \<acute>z\<rbrace>\<rbrace>
 2. \<lbrace>\<acute>Mut_init \<and> \<not> \<acute>z\<rbrace> \<inter> \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>PBInv \<acute>ind \<and> \<acute>ind < length \<acute>E \<and> \<acute>M ! fst (\<acute>E ! \<acute>ind) = Black\<rbrace> \<subseteq> \<lbrace>\<acute>(k_update (\<lambda>_. snd (\<acute>E ! \<acute>ind))) \<in> \<lbrace>\<acute>Mut_init \<and> \<not> \<acute>z\<rbrace>\<rbrace>
 3. \<lbrace>\<acute>Mut_init \<and> \<not> \<acute>z\<rbrace> \<inter> \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>PBInv \<acute>ind \<and> \<acute>ind < length \<acute>E \<and> \<acute>M ! fst (\<acute>E ! \<acute>ind) = Black \<and> \<acute>Auxk\<rbrace> \<subseteq> \<lbrace>\<acute>(M_update (\<lambda>_. \<acute>M[\<acute>k := Black])) \<in> \<lbrace>\<acute>(ind_update (\<lambda>_. \<acute>ind + 1)) \<in> \<lbrace>\<acute>Mut_init \<and> \<not> \<acute>z\<rbrace>\<rbrace>\<rbrace>
 4. \<lbrace>\<acute>Mut_init \<and> \<not> \<acute>z\<rbrace> \<inter> \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>PBInv \<acute>ind \<and> \<acute>ind < length \<acute>E\<rbrace> \<subseteq> \<lbrace>(\<acute>(\<in>) \<lbrace>\<acute>M ! fst (\<acute>E ! \<acute>ind) \<noteq> Black\<rbrace> \<longrightarrow> \<acute>(\<in>) \<lbrace>\<acute>(ind_update (\<lambda>_. \<acute>ind + 1)) \<in> \<lbrace>\<acute>Mut_init \<and> \<not> \<acute>z\<rbrace>\<rbrace>) \<and> (\<acute>(\<notin>) \<lbrace>\<acute>M ! fst (\<acute>E ! \<acute>ind) \<noteq> Black\<rbrace> \<longrightarrow> \<acute>(\<in>) \<lbrace>\<acute>Mut_init \<and> \<not> \<acute>z\<rbrace>)\<rbrace>
 5. {} \<inter> \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M\<rbrace> \<subseteq> \<lbrace>\<acute>(ind_update (\<lambda>_. 0)) \<in> {}\<rbrace>
 6. {} \<inter> \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>PBInv \<acute>ind \<and> \<acute>ind < length \<acute>E \<and> \<acute>M ! fst (\<acute>E ! \<acute>ind) = Black\<rbrace> \<subseteq> \<lbrace>\<acute>(k_update (\<lambda>_. snd (\<acute>E ! \<acute>ind))) \<in> {}\<rbrace>
 7. {} \<inter> \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>PBInv \<acute>ind \<and> \<acute>ind < length \<acute>E \<and> \<acute>M ! fst (\<acute>E ! \<acute>ind) = Black \<and> \<acute>Auxk\<rbrace> \<subseteq> \<lbrace>\<acute>(M_update (\<lambda>_. \<acute>M[\<acute>k := Black])) \<in> \<lbrace>\<acute>(ind_update (\<lambda>_. \<acute>ind + 1)) \<in> {}\<rbrace>\<rbrace>
 8. {} \<inter> \<lbrace>\<acute>Proper \<and> Roots \<subseteq> Blacks \<acute>M \<and> \<acute>obc \<subseteq> Blacks \<acute>M \<and> \<acute>bc \<subseteq> Blacks \<acute>M \<and> \<acute>PBInv \<acute>ind \<and> \<acute>ind < length \<acute>E\<rbrace> \<subseteq> \<lbrace>(\<acute>(\<in>) \<lbrace>\<acute>M ! fst (\<acute>E ! \<acute>ind) \<noteq> Black\<rbrace> \<longrightarrow> \<acute>(\<in>) \<lbrace>\<acute>(ind_update (\<lambda>_. \<acute>ind + 1)) \<in> {}\<rbrace>) \<and> (\<acute>(\<notin>) \<lbrace>\<acute>M ! fst (\<acute>E ! \<acute>ind) \<noteq> Black\<rbrace> \<longrightarrow> \<acute>(\<in>) {})\<rbrace>
[PROOF STEP]
apply(clarify, simp add:abbrev)+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma mem_val_alt_8_mem_equal_3: "mem_equal s1 s2 pa \<Longrightarrow>
mem_val_alt 8 ((pa AND 68719476732) + 3) s1 = mem_val_alt 8 ((pa AND 68719476732) + 3) s2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem_equal s1 s2 pa \<Longrightarrow> mem_val_alt 8 ((pa AND 68719476732) + 3) s1 = mem_val_alt 8 ((pa AND 68719476732) + 3) s2
[PROOF STEP]
apply (simp add: mem_val_alt_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem_equal s1 s2 pa \<Longrightarrow> (let r1 = mem s1 8 ((pa AND 68719476732) + 3) in if r1 = None then let r2 = mem s1 9 ((pa AND 68719476732) + 3) in r2 else if r1 = None \<and> uint 8 = 9 then let r2 = r1 in r2 else if r1 = None \<and> uint 8 = 10 then let r2 = mem s1 11 ((pa AND 68719476732) + 3) in if r2 = None then let r3 = r1 in if r3 = None then mem s1 9 ((pa AND 68719476732) + 3) else r3 else r2 else if r1 = None \<and> uint 8 = 11 then let r2 = mem s1 10 ((pa AND 68719476732) + 3) in if r2 = None then let r3 = r1 in if r3 = None then mem s1 9 ((pa AND 68719476732) + 3) else r3 else r2 else r1) = (let r1 = mem s2 8 ((pa AND 68719476732) + 3) in if r1 = None then let r2 = mem s2 9 ((pa AND 68719476732) + 3) in r2 else if r1 = None \<and> uint 8 = 9 then let r2 = r1 in r2 else if r1 = None \<and> uint 8 = 10 then let r2 = mem s2 11 ((pa AND 68719476732) + 3) in if r2 = None then let r3 = r1 in if r3 = None then mem s2 9 ((pa AND 68719476732) + 3) else r3 else r2 else if r1 = None \<and> uint 8 = 11 then let r2 = mem s2 10 ((pa AND 68719476732) + 3) in if r2 = None then let r3 = r1 in if r3 = None then mem s2 9 ((pa AND 68719476732) + 3) else r3 else r2 else r1)
[PROOF STEP]
apply (simp add: Let_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem_equal s1 s2 pa \<Longrightarrow> (mem s1 8 ((pa AND 68719476732) + 3) = None \<longrightarrow> (mem s2 8 ((pa AND 68719476732) + 3) = None \<longrightarrow> mem s1 9 ((pa AND 68719476732) + 3) = mem s2 9 ((pa AND 68719476732) + 3)) \<and> ((\<exists>y. mem s2 8 ((pa AND 68719476732) + 3) = Some y) \<longrightarrow> mem s1 9 ((pa AND 68719476732) + 3) = mem s2 8 ((pa AND 68719476732) + 3))) \<and> ((\<exists>y. mem s1 8 ((pa AND 68719476732) + 3) = Some y) \<longrightarrow> (mem s2 8 ((pa AND 68719476732) + 3) = None \<longrightarrow> mem s1 8 ((pa AND 68719476732) + 3) = mem s2 9 ((pa AND 68719476732) + 3)) \<and> ((\<exists>y. mem s2 8 ((pa AND 68719476732) + 3) = Some y) \<longrightarrow> mem s1 8 ((pa AND 68719476732) + 3) = mem s2 8 ((pa AND 68719476732) + 3)))
[PROOF STEP]
apply (simp add: mem_equal_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem s1 8 (pa AND 68719476732) = mem s2 8 (pa AND 68719476732) \<and> mem s1 8 ((pa AND 68719476732) + 1) = mem s2 8 ((pa AND 68719476732) + 1) \<and> mem s1 8 ((pa AND 68719476732) + 2) = mem s2 8 ((pa AND 68719476732) + 2) \<and> mem s1 8 ((pa AND 68719476732) + 3) = mem s2 8 ((pa AND 68719476732) + 3) \<and> mem s1 9 (pa AND 68719476732) = mem s2 9 (pa AND 68719476732) \<and> mem s1 9 ((pa AND 68719476732) + 1) = mem s2 9 ((pa AND 68719476732) + 1) \<and> mem s1 9 ((pa AND 68719476732) + 2) = mem s2 9 ((pa AND 68719476732) + 2) \<and> mem s1 9 ((pa AND 68719476732) + 3) = mem s2 9 ((pa AND 68719476732) + 3) \<and> mem s1 10 (pa AND 68719476732) = mem s2 10 (pa AND 68719476732) \<and> mem s1 10 ((pa AND 68719476732) + 1) = mem s2 10 ((pa AND 68719476732) + 1) \<and> mem s1 10 ((pa AND 68719476732) + 2) = mem s2 10 ((pa AND 68719476732) + 2) \<and> mem s1 10 ((pa AND 68719476732) + 3) = mem s2 10 ((pa AND 68719476732) + 3) \<and> mem s1 11 (pa AND 68719476732) = mem s2 11 (pa AND 68719476732) \<and> mem s1 11 ((pa AND 68719476732) + 1) = mem s2 11 ((pa AND 68719476732) + 1) \<and> mem s1 11 ((pa AND 68719476732) + 2) = mem s2 11 ((pa AND 68719476732) + 2) \<and> mem s1 11 ((pa AND 68719476732) + 3) = mem s2 11 ((pa AND 68719476732) + 3) \<Longrightarrow> (\<exists>y. mem s2 8 ((pa AND 68719476732) + 3) = Some y) \<longrightarrow> mem s2 8 ((pa AND 68719476732) + 3) = None \<longrightarrow> None = mem s2 9 ((pa AND 68719476732) + 3)
[PROOF STEP]
by (metis option.distinct(1))


[STATEMENT]
lemma mbisimI2:
  "\<lbrakk> finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2;
     wset_thread_ok (wset s2) (thr s2);
     \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None;
     \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2) \<rbrakk>
  \<Longrightarrow> s1 \<approx>m s2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> s1 \<approx>m s2
[PROOF STEP]
apply(auto simp add: mbisim_def tbisim_def)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> finite (dom (thr s1))
 2. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> wset_thread_ok (wset s2) (thr s1)
 3. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None\<rbrakk> \<Longrightarrow> thr s2 t = None
 4. \<And>t a b. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> wset_thread_ok (wset s2) (thr s1)
 2. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> finite (dom (thr s1))
 3. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None\<rbrakk> \<Longrightarrow> thr s2 t = None
 4. \<And>t a b. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
[PROOF STEP]
apply(rule wset_thread_okI)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None\<rbrakk> \<Longrightarrow> wset s2 t = None
 2. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> finite (dom (thr s1))
 3. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None\<rbrakk> \<Longrightarrow> thr s2 t = None
 4. \<And>t a b. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
[PROOF STEP]
apply(case_tac "thr s2 t")
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None; thr s2 t = None\<rbrakk> \<Longrightarrow> wset s2 t = None
 2. \<And>t a. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None; thr s2 t = \<lfloor>a\<rfloor>\<rbrakk> \<Longrightarrow> wset s2 t = None
 3. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> finite (dom (thr s1))
 4. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None\<rbrakk> \<Longrightarrow> thr s2 t = None
 5. \<And>t a b. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
[PROOF STEP]
apply(auto dest!: wset_thread_okD)[1]
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t a. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None; thr s2 t = \<lfloor>a\<rfloor>\<rbrakk> \<Longrightarrow> wset s2 t = None
 2. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> finite (dom (thr s1))
 3. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None\<rbrakk> \<Longrightarrow> thr s2 t = None
 4. \<And>t a b. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> finite (dom (thr s1))
 2. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None\<rbrakk> \<Longrightarrow> thr s2 t = None
 3. \<And>t a b. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
[PROOF STEP]
apply(erule back_subst[where P=finite])
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> dom (thr s2) = dom (thr s1)
 2. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None\<rbrakk> \<Longrightarrow> thr s2 t = None
 3. \<And>t a b. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
[PROOF STEP]
apply(clarsimp simp add: dom_def fun_eq_iff simp del: not_None_eq)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>locks s1 = locks s2; \<forall>x. wset s1 x = wset s2 x; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> {a. thr s2 a \<noteq> None} = {a. thr s1 a \<noteq> None}
 2. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None\<rbrakk> \<Longrightarrow> thr s2 t = None
 3. \<And>t a b. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
[PROOF STEP]
defer
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None\<rbrakk> \<Longrightarrow> thr s2 t = None
 2. \<And>t a b. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
 3. \<lbrakk>locks s1 = locks s2; \<forall>x. wset s1 x = wset s2 x; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> {a. thr s2 a \<noteq> None} = {a. thr s1 a \<noteq> None}
[PROOF STEP]
apply(rename_tac t)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None\<rbrakk> \<Longrightarrow> thr s2 t = None
 2. \<And>t a b. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
 3. \<lbrakk>locks s1 = locks s2; \<forall>x. wset s1 x = wset s2 x; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2)\<rbrakk> \<Longrightarrow> {a. thr s2 a \<noteq> None} = {a. thr s1 a \<noteq> None}
[PROOF STEP]
apply(case_tac [!] "thr s2 t")
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>t. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None; thr s2 t = None\<rbrakk> \<Longrightarrow> thr s2 t = None
 2. \<And>t a. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = None; thr s2 t = \<lfloor>a\<rfloor>\<rbrakk> \<Longrightarrow> thr s2 t = None
 3. \<And>t a b. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>; thr s2 t = None\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
 4. \<And>t a b aa. \<lbrakk>finite (dom (thr s2)); locks s1 = locks s2; wset s1 = wset s2; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s1 t = \<lfloor>(a, b)\<rfloor>; thr s2 t = \<lfloor>aa\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>x2. thr s2 t = \<lfloor>(x2, b)\<rfloor> \<and> t \<turnstile> (a, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> a \<approx>w x2)
 5. \<lbrakk>locks s1 = locks s2; \<forall>x. wset s1 x = wset s2 x; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s2 t = None\<rbrakk> \<Longrightarrow> {a. thr s2 a \<noteq> None} = {a. thr s1 a \<noteq> None}
 6. \<And>a. \<lbrakk>locks s1 = locks s2; \<forall>x. wset s1 x = wset s2 x; interrupts s1 = interrupts s2; wset_thread_ok (wset s2) (thr s2); \<And>t. thr s2 t = None \<Longrightarrow> thr s1 t = None; \<And>t x2 ln. thr s2 t = \<lfloor>(x2, ln)\<rfloor> \<Longrightarrow> \<exists>x1. thr s1 t = \<lfloor>(x1, ln)\<rfloor> \<and> t \<turnstile> (x1, shr s1) \<approx> (x2, shr s2) \<and> (wset s2 t = None \<or> x1 \<approx>w x2); thr s2 t = \<lfloor>a\<rfloor>\<rbrakk> \<Longrightarrow> {a. thr s2 a \<noteq> None} = {a. thr s1 a \<noteq> None}
[PROOF STEP]
by fastforce+