[STATEMENT]
lemma lr_of_tran_correct:
	fixes p :: "(32, 'a) simple_packet_ext_scheme"
assumes nerr: "lr_of_tran rt fw ifs = Inr oft"
	 and ippkt: "p_l2type p = 0x800"
	 and ifvld: "p_iiface p \<in> set ifs"
	shows "OF_priority_match OF_match_fields_safe oft p = Action [Forward oif] \<longleftrightarrow> simple_linux_router_nol12 rt fw p = (Some (p\<lparr>p_oiface := oif\<rparr>))"
	      "OF_priority_match OF_match_fields_safe oft p = Action [] \<longleftrightarrow> simple_linux_router_nol12 rt fw p = None"
	      (* fun stuff: *)
	      "OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction" "OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined"
	      "OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1"
	      "\<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)) &&& (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None) &&& OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction) &&& OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined &&& OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1 &&& \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
have s1: "valid_prefixes rt" "has_default_route rt"
   and s2: "has_default_policy fw" "simple_fw_valid fw" "no_oif_match fw"
   and difs: "distinct ifs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (valid_prefixes rt &&& has_default_route rt) &&& (has_default_policy fw &&& simple_fw_valid fw &&& no_oif_match fw) &&& distinct ifs
[PROOF STEP]
using nerr
[PROOF STATE]
proof (prove)
using this:
lr_of_tran rt fw ifs = Inr oft

goal (1 subgoal):
 1. (valid_prefixes rt &&& has_default_route rt) &&& (has_default_policy fw &&& simple_fw_valid fw &&& no_oif_match fw) &&& distinct ifs
[PROOF STEP]
unfolding lr_of_tran_def
[PROOF STATE]
proof (prove)
using this:
(if \<not> (no_oif_match fw \<and> has_default_policy fw \<and> simple_fw_valid fw \<and> valid_prefixes rt \<and> has_default_route rt \<and> distinct ifs) then Inl ''Error in creating OpenFlow table: prerequisites not satisifed'' else let nrd = lr_of_tran_fbs rt fw ifs; ard = map (apfst word_of_nat) (annotate_rlen nrd) in if length nrd < unat (- 1) then Inr (pack_OF_entries ifs ard) else Inl ''Error in creating OpenFlow table: priority number space exhausted'') = Inr oft

goal (1 subgoal):
 1. (valid_prefixes rt &&& has_default_route rt) &&& (has_default_policy fw &&& simple_fw_valid fw &&& no_oif_match fw) &&& distinct ifs
[PROOF STEP]
by(simp_all split: if_splits)
[PROOF STATE]
proof (state)
this:
valid_prefixes rt
has_default_route rt
has_default_policy fw
simple_fw_valid fw
no_oif_match fw
distinct ifs

goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
have "no_oif_match fw"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. no_oif_match fw
[PROOF STEP]
using nerr
[PROOF STATE]
proof (prove)
using this:
lr_of_tran rt fw ifs = Inr oft

goal (1 subgoal):
 1. no_oif_match fw
[PROOF STEP]
unfolding lr_of_tran_def
[PROOF STATE]
proof (prove)
using this:
(if \<not> (no_oif_match fw \<and> has_default_policy fw \<and> simple_fw_valid fw \<and> valid_prefixes rt \<and> has_default_route rt \<and> distinct ifs) then Inl ''Error in creating OpenFlow table: prerequisites not satisifed'' else let nrd = lr_of_tran_fbs rt fw ifs; ard = map (apfst word_of_nat) (annotate_rlen nrd) in if length nrd < unat (- 1) then Inr (pack_OF_entries ifs ard) else Inl ''Error in creating OpenFlow table: priority number space exhausted'') = Inr oft

goal (1 subgoal):
 1. no_oif_match fw
[PROOF STEP]
by(simp split: if_splits)
[PROOF STATE]
proof (state)
this:
no_oif_match fw

goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
note s2 = s2 this
[PROOF STATE]
proof (state)
this:
has_default_policy fw
simple_fw_valid fw
no_oif_match fw
no_oif_match fw

goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
have unsafe_safe_eq:
    "OF_priority_match OF_match_fields_unsafe oft = OF_priority_match OF_match_fields_safe oft"
    "OF_match_linear OF_match_fields_unsafe oft = OF_match_linear OF_match_fields_safe oft"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OF_priority_match OF_match_fields_unsafe oft = OF_priority_match OF_match_fields_safe oft &&& OF_match_linear OF_match_fields_unsafe oft = OF_match_linear OF_match_fields_safe oft
[PROOF STEP]
apply(subst OF_unsafe_safe_match3_eq; (rule lr_of_tran_prereqs s1 s2 nerr refl)+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OF_match_linear OF_match_fields_unsafe oft = OF_match_linear OF_match_fields_safe oft
[PROOF STEP]
apply(subst OF_unsafe_safe_match_linear_eq; (rule lr_of_tran_prereqs s1 s2 nerr refl)+)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
OF_priority_match OF_match_fields_unsafe oft = OF_priority_match OF_match_fields_safe oft
OF_match_linear OF_match_fields_unsafe oft = OF_match_linear OF_match_fields_safe oft

goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
have lin: "OF_priority_match OF_match_fields_safe oft = OF_match_linear OF_match_fields_safe oft"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OF_priority_match OF_match_fields_safe oft = OF_match_linear OF_match_fields_safe oft
[PROOF STEP]
using OF_eq[OF lr_of_tran_no_overlaps lr_of_tran_sorted_descending, OF difs nerr[symmetric] nerr[symmetric]]
[PROOF STATE]
proof (prove)
using this:
OF_match_linear OF_match_fields_unsafe oft ?p = OF_priority_match OF_match_fields_unsafe oft ?p

goal (1 subgoal):
 1. OF_priority_match OF_match_fields_safe oft = OF_match_linear OF_match_fields_safe oft
[PROOF STEP]
unfolding fun_eq_iff unsafe_safe_eq
[PROOF STATE]
proof (prove)
using this:
OF_match_linear OF_match_fields_safe oft ?p = OF_priority_match OF_match_fields_safe oft ?p

goal (1 subgoal):
 1. \<forall>x. OF_priority_match OF_match_fields_safe oft x = OF_match_linear OF_match_fields_safe oft x
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
OF_priority_match OF_match_fields_safe oft = OF_match_linear OF_match_fields_safe oft

goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
let ?ard = "map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs))"
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
have oft_def: "oft = pack_OF_entries ifs ?ard"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. oft = pack_OF_entries ifs (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))
[PROOF STEP]
using nerr
[PROOF STATE]
proof (prove)
using this:
lr_of_tran rt fw ifs = Inr oft

goal (1 subgoal):
 1. oft = pack_OF_entries ifs (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))
[PROOF STEP]
unfolding lr_of_tran_def Let_def
[PROOF STATE]
proof (prove)
using this:
(if \<not> (no_oif_match fw \<and> has_default_policy fw \<and> simple_fw_valid fw \<and> valid_prefixes rt \<and> has_default_route rt \<and> distinct ifs) then Inl ''Error in creating OpenFlow table: prerequisites not satisifed'' else if length (lr_of_tran_fbs rt fw ifs) < unat (- 1) then Inr (pack_OF_entries ifs (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) else Inl ''Error in creating OpenFlow table: priority number space exhausted'') = Inr oft

goal (1 subgoal):
 1. oft = pack_OF_entries ifs (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))
[PROOF STEP]
by(simp split: if_splits)
[PROOF STATE]
proof (state)
this:
oft = pack_OF_entries ifs (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))

goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
have vld: "list_all simple_match_valid (map (fst \<circ> snd) ?ard)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list_all simple_match_valid (map (fst \<circ> snd) (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs))))
[PROOF STEP]
unfolding fun_app_def map_map[symmetric] snd_apfst map_snd_apfst map_snd_annotate_rlen
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list_all simple_match_valid (map fst (lr_of_tran_fbs rt fw ifs))
[PROOF STEP]
using simple_match_valid_fbs[OF s1(1) s2(2)]
[PROOF STATE]
proof (prove)
using this:
list_all simple_match_valid (map fst (lr_of_tran_fbs rt fw ?ifs))

goal (1 subgoal):
 1. list_all simple_match_valid (map fst (lr_of_tran_fbs rt fw ifs))
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
list_all simple_match_valid (map (fst \<circ> snd) (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs))))

goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
have *: "list_all (\<lambda>m. oiface (fst (snd m)) = ifaceAny) ?ard"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list_all (\<lambda>m. oiface (fst (snd m)) = ifaceAny) (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))
[PROOF STEP]
using no_oif_match_fbs[OF s2(3)]
[PROOF STATE]
proof (prove)
using this:
list_all (\<lambda>m. oiface (fst (snd m)) = ifaceAny) (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs ?rt fw ?ifs)))

goal (1 subgoal):
 1. list_all (\<lambda>m. oiface (fst (snd m)) = ifaceAny) (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
list_all (\<lambda>m. oiface (fst (snd m)) = ifaceAny) (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))

goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
have not_undec: "\<And>p. simple_fw fw p \<noteq> Undecided"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>p. simple_fw fw p \<noteq> Undecided
[PROOF STEP]
by (metis has_default_policy s2(1) state.simps(3))
[PROOF STATE]
proof (state)
this:
simple_fw fw ?p5 \<noteq> Undecided

goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
have w1_1: "\<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)
    \<and> oif = output_iface (routing_table_semantics rt (p_dst p))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>) \<and> oif = output_iface (routing_table_semantics rt (p_dst p))
[PROOF STEP]
proof(intro conjI, goal_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)
 2. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> oif = output_iface (routing_table_semantics rt (p_dst p))
[PROOF STEP]
case (1 oif)
[PROOF STATE]
proof (state)
this:
OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]

goal (2 subgoals):
 1. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)
 2. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> oif = output_iface (routing_table_semantics rt (p_dst p))
[PROOF STEP]
note s3_correct[OF vld ippkt ifvld(1) *, THEN iffD1, unfolded oft_def[symmetric], OF 1]
[PROOF STATE]
proof (state)
this:
\<exists>r af. generalized_sfw (map snd (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, af) \<and> (if snd af = Drop then [Forward oif] = [] else [Forward oif] = [Forward (fst af)])

goal (2 subgoals):
 1. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)
 2. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> oif = output_iface (routing_table_semantics rt (p_dst p))
[PROOF STEP]
hence "\<exists>r. generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, (oif, simple_action.Accept))"
[PROOF STATE]
proof (prove)
using this:
\<exists>r af. generalized_sfw (map snd (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, af) \<and> (if snd af = Drop then [Forward oif] = [] else [Forward oif] = [Forward (fst af)])

goal (1 subgoal):
 1. \<exists>r. generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Accept)
[PROOF STEP]
by(clarsimp split: if_splits)
[PROOF STATE]
proof (state)
this:
\<exists>r. generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Accept)

goal (2 subgoals):
 1. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)
 2. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> oif = output_iface (routing_table_semantics rt (p_dst p))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>r. generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Accept)
[PROOF STEP]
obtain r where "generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, (oif, simple_action.Accept))"
[PROOF STATE]
proof (prove)
using this:
\<exists>r. generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Accept)

goal (1 subgoal):
 1. (\<And>r. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding map_map comp_def snd_apfst map_snd_annotate_rlen
[PROOF STATE]
proof (prove)
using this:
\<exists>r. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)

goal (1 subgoal):
 1. (\<And>r. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)

goal (2 subgoals):
 1. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)
 2. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> oif = output_iface (routing_table_semantics rt (p_dst p))
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)

goal (1 subgoal):
 1. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)
[PROOF STEP]
using lr_of_tran_fbs_acceptD[OF s1 s2(3)]
[PROOF STATE]
proof (prove)
using this:
generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)
generalized_sfw (lr_of_tran_fbs rt fw ?ifs) ?p = Some (?r, ?oif, Accept) \<Longrightarrow> simple_linux_router_nol12 rt fw ?p = Some (?p\<lparr>p_oiface := ?oif\<rparr>)

goal (1 subgoal):
 1. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)

goal (1 subgoal):
 1. \<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \<Longrightarrow> oif = output_iface (routing_table_semantics rt (p_dst p))
[PROOF STEP]
thus "oif = output_iface (routing_table_semantics rt (p_dst p))"
[PROOF STATE]
proof (prove)
using this:
simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)

goal (1 subgoal):
 1. oif = output_iface (routing_table_semantics rt (p_dst p))
[PROOF STEP]
by(cases p) (clarsimp simp: simple_linux_router_nol12_def Let_def not_undec split: Option.bind_splits state.splits final_decision.splits)
[PROOF STATE]
proof (state)
this:
oif = output_iface (routing_table_semantics rt (p_dst p))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
OF_match_linear OF_match_fields_safe oft p = Action [Forward ?oif6] \<Longrightarrow> simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := ?oif6\<rparr>) \<and> ?oif6 = output_iface (routing_table_semantics rt (p_dst p))

goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
have w1_2: "\<And>oif. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>oif. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]
[PROOF STEP]
proof(goal_cases)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>oif. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]
[PROOF STEP]
case (1 oif)
[PROOF STATE]
proof (state)
this:
simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>)

goal (1 subgoal):
 1. \<And>oif. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]
[PROOF STEP]
note lr_of_tran_fbs_acceptI[OF s1 s2(3) s2(1) this, of ifs]
[PROOF STATE]
proof (state)
this:
\<exists>r. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)

goal (1 subgoal):
 1. \<And>oif. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>r. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)
[PROOF STEP]
guess r
[PROOF STATE]
proof (prove)
using this:
\<exists>r. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)

goal (1 subgoal):
 1. thesis
goal instantiation:
PROP ?guess \<leadsto> thesis
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)

goal (1 subgoal):
 1. \<And>oif. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]
[PROOF STEP]
note r = this
[PROOF STATE]
proof (state)
this:
generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)

goal (1 subgoal):
 1. \<And>oif. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]
[PROOF STEP]
hence "generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, (oif, simple_action.Accept))"
[PROOF STATE]
proof (prove)
using this:
generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)

goal (1 subgoal):
 1. generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Accept)
[PROOF STEP]
unfolding map_snd_apfst map_snd_annotate_rlen
[PROOF STATE]
proof (prove)
using this:
generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)

goal (1 subgoal):
 1. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Accept)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Accept)

goal (1 subgoal):
 1. \<And>oif. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Accept)

goal (1 subgoal):
 1. \<And>oif. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]
[PROOF STEP]
note s3_correct[OF vld ippkt ifvld(1) *, THEN iffD2, unfolded oft_def[symmetric], of "[Forward oif]"]
[PROOF STATE]
proof (state)
this:
\<exists>r af. generalized_sfw (map snd (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, af) \<and> (if snd af = Drop then [Forward oif] = [] else [Forward oif] = [Forward (fst af)]) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]

goal (1 subgoal):
 1. \<And>oif. simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Accept)
\<exists>r af. generalized_sfw (map snd (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, af) \<and> (if snd af = Drop then [Forward oif] = [] else [Forward oif] = [Forward (fst af)]) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Accept)
\<exists>r af. generalized_sfw (map snd (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, af) \<and> (if snd af = Drop then [Forward oif] = [] else [Forward oif] = [Forward (fst af)]) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]

goal (1 subgoal):
 1. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := ?oif6\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward ?oif6]

goal (6 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
 2. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 4. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 5. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 6. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
show w1: "\<And>oif. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>oif. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
[PROOF STEP]
unfolding lin
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>oif. (OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
[PROOF STEP]
using w1_1 w1_2
[PROOF STATE]
proof (prove)
using this:
OF_match_linear OF_match_fields_safe oft p = Action [Forward ?oif6] \<Longrightarrow> simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := ?oif6\<rparr>) \<and> ?oif6 = output_iface (routing_table_semantics rt (p_dst p))
simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := ?oif6\<rparr>) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward ?oif6]

goal (1 subgoal):
 1. \<And>oif. (OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := oif\<rparr>))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(OF_priority_match OF_match_fields_safe oft p = Action [Forward ?oif6]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := ?oif6\<rparr>))

goal (5 subgoals):
 1. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
 2. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 3. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 4. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 5. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
show w2: "(OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
[PROOF STEP]
unfolding lin
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (OF_match_linear OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)
[PROOF STEP]
proof(rule iffI, goal_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. OF_match_linear OF_match_fields_safe oft p = Action [] \<Longrightarrow> simple_linux_router_nol12 rt fw p = None
 2. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
OF_match_linear OF_match_fields_safe oft p = Action []

goal (2 subgoals):
 1. OF_match_linear OF_match_fields_safe oft p = Action [] \<Longrightarrow> simple_linux_router_nol12 rt fw p = None
 2. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
note s3_correct[OF vld ippkt ifvld(1) *, THEN iffD1, unfolded oft_def[symmetric], OF 1]
[PROOF STATE]
proof (state)
this:
\<exists>r af. generalized_sfw (map snd (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, af) \<and> (if snd af = Drop then [] = [] else [] = [Forward (fst af)])

goal (2 subgoals):
 1. OF_match_linear OF_match_fields_safe oft p = Action [] \<Longrightarrow> simple_linux_router_nol12 rt fw p = None
 2. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>r af. generalized_sfw (map snd (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, af) \<and> (if snd af = Drop then [] = [] else [] = [Forward (fst af)])
[PROOF STEP]
obtain r oif where roif: "generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, simple_action.Drop)"
[PROOF STATE]
proof (prove)
using this:
\<exists>r af. generalized_sfw (map snd (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, af) \<and> (if snd af = Drop then [] = [] else [] = [Forward (fst af)])

goal (1 subgoal):
 1. (\<And>r oif. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Drop) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding map_snd_apfst map_snd_annotate_rlen
[PROOF STATE]
proof (prove)
using this:
\<exists>r af. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, af) \<and> (if snd af = Drop then [] = [] else [] = [Forward (fst af)])

goal (1 subgoal):
 1. (\<And>r oif. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Drop) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(clarsimp split: if_splits)
[PROOF STATE]
proof (state)
this:
generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Drop)

goal (2 subgoals):
 1. OF_match_linear OF_match_fields_safe oft p = Action [] \<Longrightarrow> simple_linux_router_nol12 rt fw p = None
 2. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
note lr_of_tran_fbs_dropD[OF s1 s2(3) this]
[PROOF STATE]
proof (state)
this:
simple_linux_router_nol12 rt fw p = None

goal (2 subgoals):
 1. OF_match_linear OF_match_fields_safe oft p = Action [] \<Longrightarrow> simple_linux_router_nol12 rt fw p = None
 2. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
simple_linux_router_nol12 rt fw p = None

goal (1 subgoal):
 1. simple_linux_router_nol12 rt fw p = None
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
simple_linux_router_nol12 rt fw p = None

goal (1 subgoal):
 1. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
simple_linux_router_nol12 rt fw p = None

goal (1 subgoal):
 1. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
note lr_of_tran_fbs_dropI[OF s1 s2(3) s2(1) this, of ifs]
[PROOF STATE]
proof (state)
this:
\<exists>r oif. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Drop)

goal (1 subgoal):
 1. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>r oif. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Drop)
[PROOF STEP]
obtain r oif where "generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, simple_action.Drop)"
[PROOF STATE]
proof (prove)
using this:
\<exists>r oif. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Drop)

goal (1 subgoal):
 1. (\<And>r oif. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Drop) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Drop)

goal (1 subgoal):
 1. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
hence "generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, simple_action.Drop)"
[PROOF STATE]
proof (prove)
using this:
generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Drop)

goal (1 subgoal):
 1. generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Drop)
[PROOF STEP]
unfolding map_snd_apfst map_snd_annotate_rlen
[PROOF STATE]
proof (prove)
using this:
generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Drop)

goal (1 subgoal):
 1. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, Drop)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Drop)

goal (1 subgoal):
 1. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Drop)

goal (1 subgoal):
 1. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
note s3_correct[OF vld ippkt ifvld(1) *, THEN iffD2, unfolded oft_def[symmetric], of "[]"]
[PROOF STATE]
proof (state)
this:
\<exists>r af. generalized_sfw (map snd (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, af) \<and> (if snd af = Drop then [] = [] else [] = [Forward (fst af)]) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []

goal (1 subgoal):
 1. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Drop)
\<exists>r af. generalized_sfw (map snd (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, af) \<and> (if snd af = Drop then [] = [] else [] = [Forward (fst af)]) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, Drop)
\<exists>r af. generalized_sfw (map snd (map (apfst word_of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, af) \<and> (if snd af = Drop then [] = [] else [] = [Forward (fst af)]) \<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action []

goal (1 subgoal):
 1. OF_match_linear OF_match_fields_safe oft p = Action []
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
OF_match_linear OF_match_fields_safe oft p = Action []

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)

goal (4 subgoals):
 1. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 2. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 3. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 4. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
have lr_determ: "\<And>a. simple_linux_router_nol12 rt fw p = Some a \<Longrightarrow> a = p\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\<rparr>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. simple_linux_router_nol12 rt fw p = Some a \<Longrightarrow> a = p\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\<rparr>
[PROOF STEP]
by(clarsimp simp: simple_linux_router_nol12_def Let_def not_undec split: Option.bind_splits state.splits final_decision.splits)
[PROOF STATE]
proof (state)
this:
simple_linux_router_nol12 rt fw p = Some ?a6 \<Longrightarrow> ?a6 = p\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\<rparr>

goal (4 subgoals):
 1. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 2. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 3. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 4. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
show notno: "OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
[PROOF STEP]
apply(cases "simple_linux_router_nol12 rt fw p")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 2. \<And>a. simple_linux_router_nol12 rt fw p = Some a \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
[PROOF STEP]
using w2
[PROOF STATE]
proof (prove)
using this:
(OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)

goal (2 subgoals):
 1. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
 2. \<And>a. simple_linux_router_nol12 rt fw p = Some a \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. simple_linux_router_nol12 rt fw p = Some a \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
[PROOF STEP]
using w1[of "output_iface (routing_table_semantics rt (p_dst p))"]
[PROOF STATE]
proof (prove)
using this:
(OF_priority_match OF_match_fields_safe oft p = Action [Forward (output_iface (routing_table_semantics rt (p_dst p)))]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\<rparr>))

goal (1 subgoal):
 1. \<And>a. simple_linux_router_nol12 rt fw p = Some a \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>simple_linux_router_nol12 rt fw p = Some a; (OF_priority_match OF_match_fields_safe oft p = Action [Forward (output_iface (routing_table_semantics rt (p_dst p)))]) = (a = p\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\<rparr>)\<rbrakk> \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
[PROOF STEP]
apply(drule lr_determ)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>(OF_priority_match OF_match_fields_safe oft p = Action [Forward (output_iface (routing_table_semantics rt (p_dst p)))]) = (a = p\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\<rparr>); a = p\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\<rparr>\<rbrakk> \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction

goal (3 subgoals):
 1. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
 2. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 3. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
show notub: "OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined
[PROOF STEP]
unfolding lin
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OF_match_linear OF_match_fields_safe oft p \<noteq> Undefined
[PROOF STEP]
using OF_match_linear_ne_Undefined
[PROOF STATE]
proof (prove)
using this:
OF_match_linear ?\<gamma> ?ft ?p \<noteq> Undefined

goal (1 subgoal):
 1. OF_match_linear OF_match_fields_safe oft p \<noteq> Undefined
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined

goal (2 subgoals):
 1. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 2. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
show notmult: "\<And>ls. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ls. OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
[PROOF STEP]
apply(cases "simple_linux_router_nol12 rt fw p")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ls. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 2. \<And>ls a. simple_linux_router_nol12 rt fw p = Some a \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
[PROOF STEP]
using w2
[PROOF STATE]
proof (prove)
using this:
(OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)

goal (2 subgoals):
 1. \<And>ls. simple_linux_router_nol12 rt fw p = None \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
 2. \<And>ls a. simple_linux_router_nol12 rt fw p = Some a \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ls a. simple_linux_router_nol12 rt fw p = Some a \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
[PROOF STEP]
using w1[of "output_iface (routing_table_semantics rt (p_dst p))"]
[PROOF STATE]
proof (prove)
using this:
(OF_priority_match OF_match_fields_safe oft p = Action [Forward (output_iface (routing_table_semantics rt (p_dst p)))]) = (simple_linux_router_nol12 rt fw p = Some (p\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\<rparr>))

goal (1 subgoal):
 1. \<And>ls a. simple_linux_router_nol12 rt fw p = Some a \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> 1
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ls a. \<lbrakk>simple_linux_router_nol12 rt fw p = Some a; (OF_priority_match OF_match_fields_safe oft p = Action [Forward (output_iface (routing_table_semantics rt (p_dst p)))]) = (a = p\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\<rparr>)\<rbrakk> \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> Suc 0
[PROOF STEP]
apply(drule lr_determ)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ls a. \<lbrakk>(OF_priority_match OF_match_fields_safe oft p = Action [Forward (output_iface (routing_table_semantics rt (p_dst p)))]) = (a = p\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\<rparr>); a = p\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\<rparr>\<rbrakk> \<Longrightarrow> OF_priority_match OF_match_fields_safe oft p = Action ls \<longrightarrow> length ls \<le> Suc 0
[PROOF STEP]
apply(clarsimp)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
OF_priority_match OF_match_fields_safe oft p = Action ?ls6 \<longrightarrow> length ?ls6 \<le> 1

goal (1 subgoal):
 1. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
show "\<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
apply(cases "OF_priority_match OF_match_fields_safe oft p")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x1. OF_priority_match OF_match_fields_safe oft p = Action x1 \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
 2. OF_priority_match OF_match_fields_safe oft p = NoAction \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
 3. OF_priority_match OF_match_fields_safe oft p = Undefined \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
using notmult
[PROOF STATE]
proof (prove)
using this:
OF_priority_match OF_match_fields_safe oft p = Action ?ls6 \<longrightarrow> length ?ls6 \<le> 1

goal (3 subgoals):
 1. \<And>x1. OF_priority_match OF_match_fields_safe oft p = Action x1 \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
 2. OF_priority_match OF_match_fields_safe oft p = NoAction \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
 3. OF_priority_match OF_match_fields_safe oft p = Undefined \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. OF_priority_match OF_match_fields_safe oft p = NoAction \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
 2. OF_priority_match OF_match_fields_safe oft p = Undefined \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
using notno
[PROOF STATE]
proof (prove)
using this:
OF_priority_match OF_match_fields_safe oft p \<noteq> NoAction

goal (2 subgoals):
 1. OF_priority_match OF_match_fields_safe oft p = NoAction \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
 2. OF_priority_match OF_match_fields_safe oft p = Undefined \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OF_priority_match OF_match_fields_safe oft p = Undefined \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
using notub
[PROOF STATE]
proof (prove)
using this:
OF_priority_match OF_match_fields_safe oft p \<noteq> Undefined

goal (1 subgoal):
 1. OF_priority_match OF_match_fields_safe oft p = Undefined \<Longrightarrow> \<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<exists>ls. length ls \<le> 1 \<and> OF_priority_match OF_match_fields_safe oft p = Action ls

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma l3_inv2_trans [simp,intro!]:
  "{l3_inv2 \<inter> l3_inv1} trans l3 {> l3_inv2}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {l3_inv2 \<inter> l3_inv1} TS.trans l3 {> l3_inv2}
[PROOF STEP]
apply (auto simp add: PO_hoare_defs l3_nostep_defs intro!: l3_inv2I)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>x xa xe xf xg. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; (xa, x) \<in> l3_step1 xe xf xg\<rbrakk> \<Longrightarrow> Keys_bad (ik x) (l3_state.bad x)
 2. \<And>x xa xc xd xf xg. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; (xa, x) \<in> l3_step2 xd xf xg xc\<rbrakk> \<Longrightarrow> Keys_bad (ik x) (l3_state.bad x)
 3. \<And>x xa xc xe xf xg. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; (xa, x) \<in> l3_step3 xe xf xg xc\<rbrakk> \<Longrightarrow> Keys_bad (ik x) (l3_state.bad x)
 4. \<And>x xa xc xd xf xg. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; (xa, x) \<in> l3_step4 xd xf xg xc\<rbrakk> \<Longrightarrow> Keys_bad (ik x) (l3_state.bad x)
 5. \<And>x xa xb. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; (xa, x) \<in> l3_dy xb\<rbrakk> \<Longrightarrow> Keys_bad (ik x) (l3_state.bad x)
 6. \<And>x xa xf. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; (xa, x) \<in> l3_lkr_others xf\<rbrakk> \<Longrightarrow> Keys_bad (ik x) (l3_state.bad x)
 7. \<And>x xa xf. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; (xa, x) \<in> l3_lkr_after xf\<rbrakk> \<Longrightarrow> Keys_bad (ik x) (l3_state.bad x)
 8. \<And>x xa xe xf. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; (xa, x) \<in> l3_skr xe xf\<rbrakk> \<Longrightarrow> Keys_bad (ik x) (l3_state.bad x)
[PROOF STEP]
apply (auto simp add: l3_defs dy_fake_msg_def dy_fake_chan_def)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xa xb. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; xb \<in> synth (analz (ik xa))\<rbrakk> \<Longrightarrow> Keys_bad (insert xb (ik xa)) (l3_state.bad xa)
 2. \<And>xa xf. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; xf \<noteq> test_owner; xf \<noteq> test_partner\<rbrakk> \<Longrightarrow> Keys_bad (keys_of xf \<union> ik xa) (insert xf (l3_state.bad xa))
 3. \<And>xa xf. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; test_ended xa\<rbrakk> \<Longrightarrow> Keys_bad (keys_of xf \<union> ik xa) (insert xf (l3_state.bad xa))
 4. \<And>xa xe xf. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; xe \<noteq> test; xe \<notin> partners; in_progress (progress xa xe) xsk; guessed_frame xe xsk = Some xf\<rbrakk> \<Longrightarrow> Keys_bad (insert xf (ik xa)) (l3_state.bad xa)
[PROOF STEP]
text \<open>4 subgoals: dy, lkr*, skr\<close>
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xa xb. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; xb \<in> synth (analz (ik xa))\<rbrakk> \<Longrightarrow> Keys_bad (insert xb (ik xa)) (l3_state.bad xa)
 2. \<And>xa xf. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; xf \<noteq> test_owner; xf \<noteq> test_partner\<rbrakk> \<Longrightarrow> Keys_bad (keys_of xf \<union> ik xa) (insert xf (l3_state.bad xa))
 3. \<And>xa xf. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; test_ended xa\<rbrakk> \<Longrightarrow> Keys_bad (keys_of xf \<union> ik xa) (insert xf (l3_state.bad xa))
 4. \<And>xa xe xf. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; xe \<noteq> test; xe \<notin> partners; in_progress (progress xa xe) xsk; guessed_frame xe xsk = Some xf\<rbrakk> \<Longrightarrow> Keys_bad (insert xf (ik xa)) (l3_state.bad xa)
[PROOF STEP]
apply (auto intro: Keys_bad_insert_Fake Keys_bad_insert_keys_of)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa xe xf. \<lbrakk>xa \<in> l3_inv2; xa \<in> l3_inv1; xe \<noteq> test; xe \<notin> partners; in_progress (progress xa xe) xsk; guessed_frame xe xsk = Some xf\<rbrakk> \<Longrightarrow> Keys_bad (insert xf (ik xa)) (l3_state.bad xa)
[PROOF STEP]
apply (auto intro!: Keys_bad_insert_payload)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma [autoref_rules]:
  "(node_impl.name_impl_update,node.name_update)
  \<in> (node_name_rel \<rightarrow> node_name_rel) \<rightarrow> \<langle>Re,R\<rangle>node_rel \<rightarrow> \<langle>Re,R\<rangle>node_rel"
  "(node_impl.incoming_impl_update,node.incoming_update)
  \<in> (\<langle>node_name_rel\<rangle>dflt_rs_rel \<rightarrow> \<langle>node_name_rel\<rangle>dflt_rs_rel)
    \<rightarrow> \<langle>Re,R\<rangle>node_rel
    \<rightarrow> \<langle>Re,R\<rangle>node_rel"
  "(node_impl.new_impl_update,node.new_update)
  \<in> (\<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<rightarrow> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel) \<rightarrow> \<langle>Re,R\<rangle>node_rel \<rightarrow> \<langle>Re,R\<rangle>node_rel"
  "(node_impl.old_impl_update,node.old_update)
  \<in> (\<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<rightarrow> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel) \<rightarrow> \<langle>Re,R\<rangle>node_rel \<rightarrow> \<langle>Re,R\<rangle>node_rel"
  "(node_impl.next_impl_update,node.next_update)
  \<in> (\<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<rightarrow> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel) \<rightarrow> \<langle>Re,R\<rangle>node_rel \<rightarrow> \<langle>Re,R\<rangle>node_rel"
  "(node_impl.more_update,node.more_update)
  \<in> (Re \<rightarrow> Re) \<rightarrow> \<langle>Re,R\<rangle>node_rel \<rightarrow> \<langle>Re,R\<rangle>node_rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((name_impl_update, name_update) \<in> (nat_rel \<rightarrow> nat_rel) \<rightarrow> \<langle>Re, R\<rangle>node_rel \<rightarrow> \<langle>Re, R\<rangle>node_rel &&& (incoming_impl_update, incoming_update) \<in> (\<langle>nat_rel\<rangle>dflt_rs_rel \<rightarrow> \<langle>nat_rel\<rangle>dflt_rs_rel) \<rightarrow> \<langle>Re, R\<rangle>node_rel \<rightarrow> \<langle>Re, R\<rangle>node_rel &&& (new_impl_update, new_update) \<in> (\<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<rightarrow> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel) \<rightarrow> \<langle>Re, R\<rangle>node_rel \<rightarrow> \<langle>Re, R\<rangle>node_rel) &&& (old_impl_update, old_update) \<in> (\<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<rightarrow> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel) \<rightarrow> \<langle>Re, R\<rangle>node_rel \<rightarrow> \<langle>Re, R\<rangle>node_rel &&& (next_impl_update, next_update) \<in> (\<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<rightarrow> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel) \<rightarrow> \<langle>Re, R\<rangle>node_rel \<rightarrow> \<langle>Re, R\<rangle>node_rel &&& (node_impl.more_update, node.more_update) \<in> (Re \<rightarrow> Re) \<rightarrow> \<langle>Re, R\<rangle>node_rel \<rightarrow> \<langle>Re, R\<rangle>node_rel
[PROOF STEP]
unfolding node_rel_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((name_impl_update, name_update) \<in> (nat_rel \<rightarrow> nat_rel) \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re} \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re} &&& (incoming_impl_update, incoming_update) \<in> (\<langle>nat_rel\<rangle>dflt_rs_rel \<rightarrow> \<langle>nat_rel\<rangle>dflt_rs_rel) \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re} \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re} &&& (new_impl_update, new_update) \<in> (\<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<rightarrow> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel) \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re} \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re}) &&& (old_impl_update, old_update) \<in> (\<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<rightarrow> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel) \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re} \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re} &&& (next_impl_update, next_update) \<in> (\<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<rightarrow> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel) \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re} \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re} &&& (node_impl.more_update, node.more_update) \<in> (Re \<rightarrow> Re) \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re} \<rightarrow> {(\<lparr>name_impl = namei, incoming_impl = inci, new_impl = newi, old_impl = oldi, next_impl = nexti, \<dots> = morei\<rparr>, \<lparr>name = name, incoming = inc, new = new, old = old, next = next, \<dots> = more\<rparr>) |namei name inci inc newi new oldi old nexti next morei more. (namei, name) \<in> nat_rel \<and> (inci, inc) \<in> \<langle>nat_rel\<rangle>dflt_rs_rel \<and> (newi, new) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (oldi, old) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (nexti, next) \<in> \<langle>\<langle>R\<rangle>ltlr_rel\<rangle>lss.rel \<and> (morei, more) \<in> Re}
[PROOF STEP]
by (auto dest: fun_relD)


[STATEMENT]
lemma OclOr_bot1[simp]: "\<And>\<tau>. X \<tau> \<noteq> true \<tau> \<Longrightarrow> (bot or X) \<tau> = bot \<tau>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<tau>. X \<tau> \<noteq> true \<tau> \<Longrightarrow> (UML_Types.bot_class.bot or X) \<tau> = UML_Types.bot_class.bot \<tau>
[PROOF STEP]
apply(simp add: OclOr_def OclAnd_def OclNot_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<tau>. X \<tau> \<noteq> true \<tau> \<Longrightarrow> (case case case UML_Types.bot_class.bot \<tau> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>\<bottom>\<rfloor> \<Rightarrow> \<lfloor>\<bottom>\<rfloor> | \<lfloor>\<lfloor>xa\<rfloor>\<rfloor> \<Rightarrow> \<lfloor>\<lfloor>\<not> xa\<rfloor>\<rfloor> of \<bottom> \<Rightarrow> case case X \<tau> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>\<bottom>\<rfloor> \<Rightarrow> \<lfloor>\<bottom>\<rfloor> | \<lfloor>\<lfloor>xa\<rfloor>\<rfloor> \<Rightarrow> \<lfloor>\<lfloor>\<not> xa\<rfloor>\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>\<bottom>\<rfloor> \<Rightarrow> \<bottom> | \<lfloor>\<lfloor>True\<rfloor>\<rfloor> \<Rightarrow> \<bottom> | \<lfloor>\<lfloor>False\<rfloor>\<rfloor> \<Rightarrow> \<lfloor>\<lfloor>False\<rfloor>\<rfloor> | \<lfloor>\<bottom>\<rfloor> \<Rightarrow> case case X \<tau> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>\<bottom>\<rfloor> \<Rightarrow> \<lfloor>\<bottom>\<rfloor> | \<lfloor>\<lfloor>xa\<rfloor>\<rfloor> \<Rightarrow> \<lfloor>\<lfloor>\<not> xa\<rfloor>\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>\<bottom>\<rfloor> \<Rightarrow> \<lfloor>\<bottom>\<rfloor> | \<lfloor>\<lfloor>True\<rfloor>\<rfloor> \<Rightarrow> \<lfloor>\<bottom>\<rfloor> | \<lfloor>\<lfloor>False\<rfloor>\<rfloor> \<Rightarrow> \<lfloor>\<lfloor>False\<rfloor>\<rfloor> | \<lfloor>\<lfloor>True\<rfloor>\<rfloor> \<Rightarrow> case X \<tau> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>\<bottom>\<rfloor> \<Rightarrow> \<lfloor>\<bottom>\<rfloor> | \<lfloor>\<lfloor>xa\<rfloor>\<rfloor> \<Rightarrow> \<lfloor>\<lfloor>\<not> xa\<rfloor>\<rfloor> | \<lfloor>\<lfloor>False\<rfloor>\<rfloor> \<Rightarrow> \<lfloor>\<lfloor>False\<rfloor>\<rfloor> of \<bottom> \<Rightarrow> \<bottom> | \<lfloor>\<bottom>\<rfloor> \<Rightarrow> \<lfloor>\<bottom>\<rfloor> | \<lfloor>\<lfloor>xa\<rfloor>\<rfloor> \<Rightarrow> \<lfloor>\<lfloor>\<not> xa\<rfloor>\<rfloor>) = UML_Types.bot_class.bot \<tau>
[PROOF STEP]
apply(auto simp:true_def false_def bot_fun_def bot_option_def
             split: option.split option.split_asm)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma mem_correct_default:
  "mem_correct
    (\<lambda> k. do {m \<leftarrow> State_Monad.get; State_Monad.return (m k)})
    (\<lambda> k v. do {m \<leftarrow> State_Monad.get; State_Monad.set (m(k\<mapsto>v))})
    (\<lambda> _. True)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem_correct (\<lambda>k. State_Monad.get \<bind> (\<lambda>m. State_Monad.return (m k))) (\<lambda>k v. State_Monad.get \<bind> (\<lambda>m. State_Monad.set (m(k \<mapsto> v)))) (\<lambda>_. True)
[PROOF STEP]
by standard
    (auto simp: map_le_def state_mem_defs.map_of_def State_Monad.bind_def State_Monad.get_def State_Monad.return_def State_Monad.set_def lift_p_def)


[STATEMENT]
lemma bc_mt_corresp_Store_init:
  "i < length LT \<Longrightarrow> bc_mt_corresp [Store i] (storeST i T) (T # ST, LT) cG rT mxr (Suc 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i < length LT \<Longrightarrow> bc_mt_corresp [Store i] (storeST i T) (T # ST, LT) cG rT mxr (Suc 0)
[PROOF STEP]
apply (simp add: bc_mt_corresp_def storeST_def wt_instr_altern_def eff_def norm_eff_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i < length LT \<Longrightarrow> check_type cG (Suc (length ST)) mxr (OK (Some (T # ST, LT))) \<longrightarrow> check_type cG (max_ssize [Some (T # ST, LT), Some (ST, LT[i := OK T])]) mxr (OK (Some (T # ST, LT))) \<and> check_type cG (max_ssize [Some (T # ST, LT), Some (ST, LT[i := OK T])]) mxr (OK (Some (ST, LT[i := OK T])))
[PROOF STEP]
apply (simp add: max_ssize_def  max_of_list_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i < length LT \<Longrightarrow> check_type cG (Suc (length ST)) mxr (OK (Some (T # ST, LT))) \<longrightarrow> check_type cG (max (ssize_sto (Some (T # ST, LT))) (ssize_sto (Some (ST, LT[i := OK T])))) mxr (OK (Some (T # ST, LT))) \<and> check_type cG (max (ssize_sto (Some (T # ST, LT))) (ssize_sto (Some (ST, LT[i := OK T])))) mxr (OK (Some (ST, LT[i := OK T])))
[PROOF STEP]
apply (simp add: ssize_sto_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i < length LT \<Longrightarrow> check_type cG (Suc (length ST)) mxr (OK (Some (T # ST, LT))) \<longrightarrow> check_type cG (Suc (length ST)) mxr (OK (Some (ST, LT[i := OK T])))
[PROOF STEP]
apply (intro strip)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i < length LT; check_type cG (Suc (length ST)) mxr (OK (Some (T # ST, LT)))\<rbrakk> \<Longrightarrow> check_type cG (Suc (length ST)) mxr (OK (Some (ST, LT[i := OK T])))
[PROOF STEP]
apply (simp add: check_type_simps max.absorb1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i < length LT; (\<exists>n. T # ST \<in> list n (types cG) \<and> n \<le> Suc (length ST)) \<and> LT \<in> list mxr (err (types cG))\<rbrakk> \<Longrightarrow> (\<exists>n. ST \<in> list n (types cG) \<and> n \<le> Suc (length ST)) \<and> LT[i := OK T] \<in> list mxr (err (types cG))
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n n'. \<lbrakk>i < length LT; LT \<in> list mxr (err (types cG)); ST \<in> list n' (types cG); n' \<le> length ST; is_type cG T\<rbrakk> \<Longrightarrow> (\<exists>n. ST \<in> list n (types cG) \<and> n \<le> Suc (length ST)) \<and> LT[i := OK T] \<in> list mxr (err (types cG))
[PROOF STEP]
apply (rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>n n'. \<lbrakk>i < length LT; LT \<in> list mxr (err (types cG)); ST \<in> list n' (types cG); n' \<le> length ST; is_type cG T\<rbrakk> \<Longrightarrow> \<exists>n. ST \<in> list n (types cG) \<and> n \<le> Suc (length ST)
 2. \<And>n n'. \<lbrakk>i < length LT; LT \<in> list mxr (err (types cG)); ST \<in> list n' (types cG); n' \<le> length ST; is_type cG T\<rbrakk> \<Longrightarrow> LT[i := OK T] \<in> list mxr (err (types cG))
[PROOF STEP]
apply (rule_tac x="(length ST)" in exI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>n n'. \<lbrakk>i < length LT; LT \<in> list mxr (err (types cG)); ST \<in> list n' (types cG); n' \<le> length ST; is_type cG T\<rbrakk> \<Longrightarrow> ST \<in> list (length ST) (types cG) \<and> length ST \<le> Suc (length ST)
 2. \<And>n n'. \<lbrakk>i < length LT; LT \<in> list mxr (err (types cG)); ST \<in> list n' (types cG); n' \<le> length ST; is_type cG T\<rbrakk> \<Longrightarrow> LT[i := OK T] \<in> list mxr (err (types cG))
[PROOF STEP]
apply simp+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma Inputs_Card: "\<lbrakk> Inputs A C X \<in> set evs; A \<noteq> Spy; evs \<in> sr \<rbrakk>
      \<Longrightarrow> C = (Card A) \<and> legalUse(C)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Inputs A C X \<in> set evs; A \<noteq> Spy; evs \<in> sr\<rbrakk> \<Longrightarrow> C = Card A \<and> legalUse C
[PROOF STEP]
apply (erule rev_mp, erule sr.induct)
[PROOF STATE]
proof (prove)
goal (20 subgoals):
 1. A \<noteq> Spy \<Longrightarrow> Inputs A C X \<in> set [] \<longrightarrow> C = Card A \<and> legalUse C
 2. \<And>evsF Xa B Aa. \<lbrakk>A \<noteq> Spy; evsF \<in> sr; Inputs A C X \<in> set evsF \<longrightarrow> C = Card A \<and> legalUse C; Xa \<in> synth (analz (knows Spy evsF)); illegalUse (Card B)\<rbrakk> \<Longrightarrow> Inputs A C X \<in> set (Says Spy Aa Xa # Inputs Spy (Card B) Xa # evsF) \<longrightarrow> C = Card A \<and> legalUse C
 3. \<And>evsFo Nb Aa B. \<lbrakk>A \<noteq> Spy; evsFo \<in> sr; Inputs A C X \<in> set evsFo \<longrightarrow> C = Card A \<and> legalUse C; Nonce Nb \<in> analz (knows Spy evsFo); Key (pairK (Aa, B)) \<in> knows Spy evsFo\<rbrakk> \<Longrightarrow> Inputs A C X \<in> set (Notes Spy (Key (sesK (Nb, pairK (Aa, B)))) # evsFo) \<longrightarrow> C = Card A \<and> legalUse C
 4. \<And>evsR Aa B Xa. \<lbrakk>A \<noteq> Spy; evsR \<in> sr; Inputs A C X \<in> set evsR \<longrightarrow> C = Card A \<and> legalUse C; Says Aa B Xa \<in> set evsR\<rbrakk> \<Longrightarrow> Inputs A C X \<in> set (Gets B Xa # evsR) \<longrightarrow> C = Card A \<and> legalUse C
 5. \<And>evs1 Aa B. \<lbrakk>A \<noteq> Spy; evs1 \<in> sr; Inputs A C X \<in> set evs1 \<longrightarrow> C = Card A \<and> legalUse C; Aa \<noteq> Server\<rbrakk> \<Longrightarrow> Inputs A C X \<in> set (Says Aa Server \<lbrace>Agent Aa, Agent B\<rbrace> # evs1) \<longrightarrow> C = Card A \<and> legalUse C
 6. \<And>evs2 Aa B. \<lbrakk>A \<noteq> Spy; evs2 \<in> sr; Inputs A C X \<in> set evs2 \<longrightarrow> C = Card A \<and> legalUse C; Gets Server \<lbrace>Agent Aa, Agent B\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> Inputs A C X \<in> set (Says Server Aa \<lbrace>Nonce (Pairkey (Aa, B)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, B)), Agent B\<rbrace>\<rbrace> # evs2) \<longrightarrow> C = Card A \<and> legalUse C
 7. \<And>evs3 Aa B Pk Certificate. \<lbrakk>A \<noteq> Spy; evs3 \<in> sr; Inputs A C X \<in> set evs3 \<longrightarrow> C = Card A \<and> legalUse C; legalUse Card Aa; Says Aa Server \<lbrace>Agent Aa, Agent B\<rbrace> \<in> set evs3; Gets Aa \<lbrace>Nonce Pk, Certificate\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> Inputs A C X \<in> set (Inputs Aa (Card Aa) (Agent Aa) # evs3) \<longrightarrow> C = Card A \<and> legalUse C
 8. \<And>evs4 Aa Na. \<lbrakk>A \<noteq> Spy; evs4 \<in> sr; Inputs A C X \<in> set evs4 \<longrightarrow> C = Card A \<and> legalUse C; Aa \<noteq> Server; Nonce Na \<notin> used evs4; legalUse Card Aa; Inputs Aa (Card Aa) (Agent Aa) \<in> set evs4\<rbrakk> \<Longrightarrow> Inputs A C X \<in> set (Outpts (Card Aa) Aa \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4) \<longrightarrow> C = Card A \<and> legalUse C
 9. \<And>evs4F Na Aa. \<lbrakk>A \<noteq> Spy; evs4F \<in> sr; Inputs A C X \<in> set evs4F \<longrightarrow> C = Card A \<and> legalUse C; Nonce Na \<notin> used evs4F; illegalUse (Card Aa); Inputs Spy (Card Aa) (Agent Aa) \<in> set evs4F\<rbrakk> \<Longrightarrow> Inputs A C X \<in> set (Outpts (Card Aa) Spy \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4F) \<longrightarrow> C = Card A \<and> legalUse C
 10. \<And>evs5 Aa Na Certificate B. \<lbrakk>A \<noteq> Spy; evs5 \<in> sr; Inputs A C X \<in> set evs5 \<longrightarrow> C = Card A \<and> legalUse C; Outpts (Card Aa) Aa \<lbrace>Nonce Na, Certificate\<rbrace> \<in> set evs5; \<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>\<rbrakk> \<Longrightarrow> Inputs A C X \<in> set (Says Aa B \<lbrace>Agent Aa, Nonce Na\<rbrace> # evs5) \<longrightarrow> C = Card A \<and> legalUse C
A total of 20 subgoals...
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma prj_char:
    shows "SPN_fgh.Prj\<^sub>1\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.\<rho>\<sigma>.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>"
    and "SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.\<rho>\<sigma>.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>"
    and "SPN_fgh.Prj\<^sub>0 = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>"
    and "SPN_fgh.Prj\<^sub>1 = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>"
    and "SPN_fgh.Prj\<^sub>1\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.\<rho>\<sigma>.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>"
    and "SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.\<rho>\<sigma>.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (SPN_fgh.Prj\<^sub>1\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk> &&& SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk> &&& SPN_fgh.Prj\<^sub>0 = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>) &&& SPN_fgh.Prj\<^sub>1 = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk> &&& SPN_fgh.Prj\<^sub>1\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk> &&& SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. SPN_fgh.Prj\<^sub>1\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
 2. SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
 3. SPN_fgh.Prj\<^sub>0 = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>
 4. SPN_fgh.Prj\<^sub>1 = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>
 5. SPN_fgh.Prj\<^sub>1\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
 6. SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
show "SPN_fgh.Prj\<^sub>1\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.\<rho>\<sigma>.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>1\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>1\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
have "ide (Tfg.\<rho>\<sigma>.p\<^sub>1 \<star> TTfgh.p\<^sub>1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ide (Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1)
[PROOF STEP]
by (metis TTfgh.composable TTfgh.leg1_simps(2) Tfg.\<rho>\<sigma>.T0.antipar(2)
              Tfg.\<rho>\<sigma>.T0.ide_right Tfg_Hfg.u_simps(3) f.T0.antipar(2) f.T0.ide_right
              f.u_simps(3) fg g.ide_leg1 g.leg1_simps(4) h.ide_leg1 h.leg1_simps(4)
              ide_hcomp hseqE hcomp_simps(1) tab\<^sub>1_simps(1))
[PROOF STATE]
proof (state)
this:
ide (Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1)

goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>1\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
ide (Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1)

goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>1\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
using fg gh Tfg.\<rho>\<sigma>.prj_char TTfgh.prj_char isomorphic_reflexive
                Maps.comp_CLS [of "tab\<^sub>0 g" Tfg.\<rho>\<sigma>.p\<^sub>0 "tab\<^sub>0 g \<star> Tfg.\<rho>\<sigma>.p\<^sub>0"]
                Maps.comp_CLS [of Tfg.\<rho>\<sigma>.p\<^sub>1 TTfgh.p\<^sub>1 "Tfg.\<rho>\<sigma>.p\<^sub>1 \<star> TTfgh.p\<^sub>1"]
[PROOF STATE]
proof (prove)
using this:
ide (Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1)
src f = trg g
src g = trg h
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
ide ?f \<Longrightarrow> ?f \<cong> ?f
\<lbrakk>is_left_adjoint (tab\<^sub>0 g); is_left_adjoint Tfg.p\<^sub>0; tab\<^sub>0 g \<star> Tfg.p\<^sub>0 \<cong> tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk> \<Longrightarrow> \<lbrakk>\<lbrakk>tab\<^sub>0 g\<rbrakk>\<rbrakk> \<odot> \<lbrakk>\<lbrakk>Tfg.p\<^sub>0\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk>\<rbrakk>
\<lbrakk>is_left_adjoint Tfg.p\<^sub>1; is_left_adjoint TTfgh.p\<^sub>1; Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1 \<cong> Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk> \<Longrightarrow> \<lbrakk>\<lbrakk>Tfg.p\<^sub>1\<rbrakk>\<rbrakk> \<odot> \<lbrakk>\<lbrakk>TTfgh.p\<^sub>1\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>

goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>1\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
by (simp add: TTfgh.composable Tfg.\<rho>\<sigma>.T0.antipar(2))
[PROOF STATE]
proof (state)
this:
SPN_fgh.Prj\<^sub>1\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
SPN_fgh.Prj\<^sub>1\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>

goal (5 subgoals):
 1. SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
 2. SPN_fgh.Prj\<^sub>0 = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>
 3. SPN_fgh.Prj\<^sub>1 = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>
 4. SPN_fgh.Prj\<^sub>1\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
 5. SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
show "SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.\<rho>\<sigma>.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
have "ide (Tfg.\<rho>\<sigma>.p\<^sub>0 \<star> TTfgh.p\<^sub>1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ide (Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1)
[PROOF STEP]
by (metis TTfgh.leg1_simps(2) bicategory_of_spans.tab\<^sub>0_simps(1)
              bicategory_of_spans.tab\<^sub>1_simps(1) bicategory_of_spans_axioms
              Tfg.\<rho>\<sigma>.T0.antipar(2) Tfg.\<rho>\<sigma>.T0.ide_right Tfg.composable f.T0.antipar(2)
              f.T0.ide_right f.u_simps(3) g.ide_leg1 g.leg1_simps(4)
              Tfg.u_simps(3) THfgh.composable h.ide_leg1 h.leg1_simps(4)
              ide_hcomp hseqE hcomp_simps(1) tab\<^sub>1_simps(3))
[PROOF STATE]
proof (state)
this:
ide (Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1)

goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
ide (Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1)

goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
using fg gh Tfg.\<rho>\<sigma>.prj_char TTfgh.prj_char isomorphic_reflexive
                Maps.comp_CLS [of "tab\<^sub>0 g" Tfg.\<rho>\<sigma>.p\<^sub>0 "tab\<^sub>0 g \<star> Tfg.\<rho>\<sigma>.p\<^sub>0"]
                Maps.comp_CLS [of Tfg.\<rho>\<sigma>.p\<^sub>0 TTfgh.p\<^sub>1 "Tfg.\<rho>\<sigma>.p\<^sub>0 \<star> TTfgh.p\<^sub>1"]
[PROOF STATE]
proof (prove)
using this:
ide (Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1)
src f = trg g
src g = trg h
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
ide ?f \<Longrightarrow> ?f \<cong> ?f
\<lbrakk>is_left_adjoint (tab\<^sub>0 g); is_left_adjoint Tfg.p\<^sub>0; tab\<^sub>0 g \<star> Tfg.p\<^sub>0 \<cong> tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk> \<Longrightarrow> \<lbrakk>\<lbrakk>tab\<^sub>0 g\<rbrakk>\<rbrakk> \<odot> \<lbrakk>\<lbrakk>Tfg.p\<^sub>0\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk>\<rbrakk>
\<lbrakk>is_left_adjoint Tfg.p\<^sub>0; is_left_adjoint TTfgh.p\<^sub>1; Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1 \<cong> Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk> \<Longrightarrow> \<lbrakk>\<lbrakk>Tfg.p\<^sub>0\<rbrakk>\<rbrakk> \<odot> \<lbrakk>\<lbrakk>TTfgh.p\<^sub>1\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>

goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
by (simp add: Tfg.\<rho>\<sigma>.T0.antipar(2) THfgh.composable)
[PROOF STATE]
proof (state)
this:
SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
SPN_fgh.Prj\<^sub>0\<^sub>1 = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0 \<star> TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>

goal (4 subgoals):
 1. SPN_fgh.Prj\<^sub>0 = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>
 2. SPN_fgh.Prj\<^sub>1 = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>
 3. SPN_fgh.Prj\<^sub>1\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
 4. SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
show "SPN_fgh.Prj\<^sub>0 = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>0 = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
using isomorphic_reflexive TTfgh.prj_char Tfg.\<rho>\<sigma>.prj_char
              Maps.comp_CLS [of "tab\<^sub>0 g" Tfg.\<rho>\<sigma>.p\<^sub>0 "tab\<^sub>0 g \<star> Tfg.\<rho>\<sigma>.p\<^sub>0"]
[PROOF STATE]
proof (prove)
using this:
ide ?f \<Longrightarrow> ?f \<cong> ?f
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>1\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tfg.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tfg.p\<^sub>1\<rbrakk>\<rbrakk>
\<lbrakk>is_left_adjoint (tab\<^sub>0 g); is_left_adjoint Tfg.p\<^sub>0; tab\<^sub>0 g \<star> Tfg.p\<^sub>0 \<cong> tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk> \<Longrightarrow> \<lbrakk>\<lbrakk>tab\<^sub>0 g\<rbrakk>\<rbrakk> \<odot> \<lbrakk>\<lbrakk>Tfg.p\<^sub>0\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>tab\<^sub>0 g \<star> Tfg.p\<^sub>0\<rbrakk>\<rbrakk>

goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>0 = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
by (simp add: Tfg.composable)
[PROOF STATE]
proof (state)
this:
SPN_fgh.Prj\<^sub>0 = \<lbrakk>\<lbrakk>TTfgh.p\<^sub>0\<rbrakk>\<rbrakk>

goal (3 subgoals):
 1. SPN_fgh.Prj\<^sub>1 = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>
 2. SPN_fgh.Prj\<^sub>1\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
 3. SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
show "SPN_fgh.Prj\<^sub>1 = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>1 = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
using Tgh.\<rho>\<sigma>.prj_char isomorphic_reflexive Tgh.composable
              Maps.comp_CLS [of "tab\<^sub>1 g" Tgh.\<rho>\<sigma>.p\<^sub>1 "tab\<^sub>1 g \<star> Tgh.\<rho>\<sigma>.p\<^sub>1"]
              TfTgh.prj_char
[PROOF STATE]
proof (prove)
using this:
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 g\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 g\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1\<rbrakk>\<rbrakk>
ide ?f \<Longrightarrow> ?f \<cong> ?f
src g = trg h
\<lbrakk>is_left_adjoint (tab\<^sub>1 g); is_left_adjoint Tgh.p\<^sub>1; tab\<^sub>1 g \<star> Tgh.p\<^sub>1 \<cong> tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk> \<Longrightarrow> \<lbrakk>\<lbrakk>tab\<^sub>1 g\<rbrakk>\<rbrakk> \<odot> \<lbrakk>\<lbrakk>Tgh.p\<^sub>1\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>

goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>1 = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
SPN_fgh.Prj\<^sub>1 = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>

goal (2 subgoals):
 1. SPN_fgh.Prj\<^sub>1\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
 2. SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
show "SPN_fgh.Prj\<^sub>1\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.\<rho>\<sigma>.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>1\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
using fg gh Tgh.\<rho>\<sigma>.prj_char TfTgh.prj_char isomorphic_reflexive
              Maps.comp_CLS [of "tab\<^sub>1 g" "prj\<^sub>1 (tab\<^sub>1 h) (tab\<^sub>0 g)" "tab\<^sub>1 g \<star> Tgh.\<rho>\<sigma>.p\<^sub>1"]
              Maps.comp_CLS [of Tgh.\<rho>\<sigma>.p\<^sub>1 TfTgh.p\<^sub>0 "Tgh.\<rho>\<sigma>.p\<^sub>1 \<star> TfTgh.p\<^sub>0"]
[PROOF STATE]
proof (prove)
using this:
src f = trg g
src g = trg h
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 g\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 g\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>
ide ?f \<Longrightarrow> ?f \<cong> ?f
\<lbrakk>is_left_adjoint (tab\<^sub>1 g); is_left_adjoint Tgh.p\<^sub>1; tab\<^sub>1 g \<star> Tgh.p\<^sub>1 \<cong> tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk> \<Longrightarrow> \<lbrakk>\<lbrakk>tab\<^sub>1 g\<rbrakk>\<rbrakk> \<odot> \<lbrakk>\<lbrakk>Tgh.p\<^sub>1\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk>\<rbrakk>
\<lbrakk>is_left_adjoint Tgh.p\<^sub>1; is_left_adjoint TfTgh.p\<^sub>0; Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0 \<cong> Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk> \<Longrightarrow> \<lbrakk>\<lbrakk>Tgh.p\<^sub>1\<rbrakk>\<rbrakk> \<odot> \<lbrakk>\<lbrakk>TfTgh.p\<^sub>0\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>

goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>1\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
SPN_fgh.Prj\<^sub>1\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>

goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
show "SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.\<rho>\<sigma>.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
using fg gh Tgh.\<rho>\<sigma>.prj_char TfTgh.prj_char isomorphic_reflexive
              Maps.comp_CLS [of "tab\<^sub>1 g" "Tgh.\<rho>\<sigma>.p\<^sub>1" "tab\<^sub>1 g \<star> Tgh.\<rho>\<sigma>.p\<^sub>1"]
              Maps.comp_CLS [of Tgh.\<rho>\<sigma>.p\<^sub>0 TfTgh.p\<^sub>0 "Tgh.\<rho>\<sigma>.p\<^sub>0 \<star> TfTgh.p\<^sub>0"]
[PROOF STATE]
proof (prove)
using this:
src f = trg g
src g = trg h
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 g\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 g\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 h\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tgh.p\<^sub>1\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>0 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
Maps.PRJ\<^sub>1 \<lbrakk>\<lbrakk>tab\<^sub>0 f\<rbrakk>\<rbrakk> \<lbrakk>\<lbrakk>tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>TfTgh.p\<^sub>1\<rbrakk>\<rbrakk>
ide ?f \<Longrightarrow> ?f \<cong> ?f
\<lbrakk>is_left_adjoint (tab\<^sub>1 g); is_left_adjoint Tgh.p\<^sub>1; tab\<^sub>1 g \<star> Tgh.p\<^sub>1 \<cong> tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk> \<Longrightarrow> \<lbrakk>\<lbrakk>tab\<^sub>1 g\<rbrakk>\<rbrakk> \<odot> \<lbrakk>\<lbrakk>Tgh.p\<^sub>1\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>tab\<^sub>1 g \<star> Tgh.p\<^sub>1\<rbrakk>\<rbrakk>
\<lbrakk>is_left_adjoint Tgh.p\<^sub>0; is_left_adjoint TfTgh.p\<^sub>0; Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0 \<cong> Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk> \<Longrightarrow> \<lbrakk>\<lbrakk>Tgh.p\<^sub>0\<rbrakk>\<rbrakk> \<odot> \<lbrakk>\<lbrakk>TfTgh.p\<^sub>0\<rbrakk>\<rbrakk> = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>

goal (1 subgoal):
 1. SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
SPN_fgh.Prj\<^sub>0\<^sub>0 = \<lbrakk>\<lbrakk>Tgh.p\<^sub>0 \<star> TfTgh.p\<^sub>0\<rbrakk>\<rbrakk>

goal:
No subgoals!
[PROOF STEP]
qed