[STATEMENT]
lemma chine_counit_in_hom:
    shows "\<guillemotleft>\<epsilon>.chine : f.leg0 \<down>\<down> g.leg1 \<rightarrow>\<^sub>C f.dtrg\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<epsilon>.chine : f.leg0 \<down>\<down> g.leg1 \<rightarrow>\<^sub>C f.dtrg\<guillemotright>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<guillemotleft>\<epsilon>.chine : f.leg0 \<down>\<down> g.leg1 \<rightarrow>\<^sub>C f.dtrg\<guillemotright>
[PROOF STEP]
have "\<guillemotleft>\<epsilon>.chine : \<epsilon>.dom.apex \<rightarrow>\<^sub>C \<epsilon>.cod.apex\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<epsilon>.chine : \<epsilon>.dom.apex \<rightarrow>\<^sub>C \<epsilon>.cod.apex\<guillemotright>
[PROOF STEP]
using \<epsilon>.chine_in_hom
[PROOF STATE]
proof (prove)
using this:
\<guillemotleft>\<epsilon>.chine : \<epsilon>.dom.apex \<rightarrow>\<^sub>C \<epsilon>.cod.apex\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>\<epsilon>.chine : \<epsilon>.dom.apex \<rightarrow>\<^sub>C \<epsilon>.cod.apex\<guillemotright>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<epsilon>.chine : \<epsilon>.dom.apex \<rightarrow>\<^sub>C \<epsilon>.cod.apex\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>\<epsilon>.chine : f.leg0 \<down>\<down> g.leg1 \<rightarrow>\<^sub>C f.dtrg\<guillemotright>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<epsilon>.chine : \<epsilon>.dom.apex \<rightarrow>\<^sub>C \<epsilon>.cod.apex\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>\<epsilon>.chine : f.leg0 \<down>\<down> g.leg1 \<rightarrow>\<^sub>C f.dtrg\<guillemotright>
[PROOF STEP]
have "\<epsilon>.cod.apex = f.dtrg"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<epsilon>.cod.apex = f.dtrg
[PROOF STEP]
using \<epsilon>.cod.apex_def cod_char counit_simps trg_def gf.composable
[PROOF STATE]
proof (prove)
using this:
\<epsilon>.cod.apex \<equiv> C.dom \<epsilon>.cod.leg0
cod = (\<lambda>\<mu>. if arr \<mu> then \<lparr>Chn = span_in_category.apex (\<cdot>) (Cod \<mu>), Dom = Cod \<mu>, Cod = Cod \<mu>\<rparr> else null)
arr \<epsilon>
local.dom \<epsilon> = f \<star> g
cod \<epsilon> = trg f
src \<epsilon> = trg f
trg \<epsilon> = trg f
trg ?\<mu> \<equiv> if arr ?\<mu> then mkObj (C.cod (Leg1 (Dom ?\<mu>))) else null
src g = trg f

goal (1 subgoal):
 1. \<epsilon>.cod.apex = f.dtrg
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<epsilon>.cod.apex = f.dtrg

goal (1 subgoal):
 1. \<guillemotleft>\<epsilon>.chine : f.leg0 \<down>\<down> g.leg1 \<rightarrow>\<^sub>C f.dtrg\<guillemotright>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<epsilon>.cod.apex = f.dtrg

goal (1 subgoal):
 1. \<guillemotleft>\<epsilon>.chine : f.leg0 \<down>\<down> g.leg1 \<rightarrow>\<^sub>C f.dtrg\<guillemotright>
[PROOF STEP]
have "\<epsilon>.dom.apex = f.leg0 \<down>\<down> g.leg1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<epsilon>.dom.apex = f.leg0 \<down>\<down> g.leg1
[PROOF STEP]
by (metis Chn_in_hom \<epsilon>.chine_simps(2) category.in_homE counit_in_hom(2)
                  fg.chine_composite span_vertical_category_axioms span_vertical_category_def)
[PROOF STATE]
proof (state)
this:
\<epsilon>.dom.apex = f.leg0 \<down>\<down> g.leg1

goal (1 subgoal):
 1. \<guillemotleft>\<epsilon>.chine : f.leg0 \<down>\<down> g.leg1 \<rightarrow>\<^sub>C f.dtrg\<guillemotright>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<guillemotleft>\<epsilon>.chine : \<epsilon>.dom.apex \<rightarrow>\<^sub>C \<epsilon>.cod.apex\<guillemotright>
\<epsilon>.cod.apex = f.dtrg
\<epsilon>.dom.apex = f.leg0 \<down>\<down> g.leg1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<guillemotleft>\<epsilon>.chine : \<epsilon>.dom.apex \<rightarrow>\<^sub>C \<epsilon>.cod.apex\<guillemotright>
\<epsilon>.cod.apex = f.dtrg
\<epsilon>.dom.apex = f.leg0 \<down>\<down> g.leg1

goal (1 subgoal):
 1. \<guillemotleft>\<epsilon>.chine : f.leg0 \<down>\<down> g.leg1 \<rightarrow>\<^sub>C f.dtrg\<guillemotright>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<epsilon>.chine : f.leg0 \<down>\<down> g.leg1 \<rightarrow>\<^sub>C f.dtrg\<guillemotright>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma test_impl_refine:
  assumes "x'+y'<2^LENGTH(32)"
  assumes "(x,x')\<in>word_nat_rel"
  assumes "(y,y')\<in>word_nat_rel"
  shows "test_impl x y \<le> \<Down>(\<langle>word_nat_rel\<rangle>set_rel) (test x' y')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. test_impl x y \<le> \<Down> (\<langle>word_nat_rel\<rangle>set_rel) (test x' y')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. test_impl x y \<le> \<Down> (\<langle>word_nat_rel\<rangle>set_rel) (test x' y')
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
x' + y' < 2 ^ LENGTH(32)
(x, x') \<in> word_nat_rel
(y, y') \<in> word_nat_rel
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
x' + y' < 2 ^ LENGTH(32)
(x, x') \<in> word_nat_rel
(y, y') \<in> word_nat_rel

goal (1 subgoal):
 1. test_impl x y \<le> \<Down> (\<langle>word_nat_rel\<rangle>set_rel) (test x' y')
[PROOF STEP]
unfolding test_impl_def test_def
[PROOF STATE]
proof (prove)
using this:
x' + y' < 2 ^ LENGTH(32)
(x, x') \<in> word_nat_rel
(y, y') \<in> word_nat_rel

goal (1 subgoal):
 1. (let S = {} in WHILE (\<lambda>(S, x, y). 0 < x) (\<lambda>(S, x, y). let S = S \<union> {y}; x = x - 1; y = y + 1 in RETURN (S, x, y)) (S, x, y) \<bind> (\<lambda>(S, uu_, uu_). RETURN S)) \<le> \<Down> (\<langle>word_nat_rel\<rangle>set_rel) (let S = {} in WHILE (\<lambda>(S, x, y). 0 < x) (\<lambda>(S, x, y). let S = S \<union> {y}; x = x - 1 in ASSERT (y < x' + y') \<bind> (\<lambda>_. let y = y + 1 in RETURN (S, x, y))) (S, x', y') \<bind> (\<lambda>(S, uu_, uu_). RETURN S))
[PROOF STEP]
apply (refine_rcg)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>x' + y' < 2 ^ LENGTH(32); (x, x') \<in> word_nat_rel; (y, y') \<in> word_nat_rel\<rbrakk> \<Longrightarrow> (({}, x, y), {}, x', y') \<in> ?R'4
 2. \<And>xa x'a x1 x2 x1a x2a x1b x2b x1c x2c. \<lbrakk>x' + y' < 2 ^ LENGTH(32); (x, x') \<in> word_nat_rel; (y, y') \<in> word_nat_rel; (xa, x'a) \<in> ?R'4; x2 = (x1a, x2a); xa = (x1, x2); x2b = (x1c, x2c); x'a = (x1b, x2b)\<rbrakk> \<Longrightarrow> (0 < x1a) = (0 < x1c)
 3. \<And>xa x'a x1 x2 x1a x2a x1b x2b x1c x2c. \<lbrakk>x' + y' < 2 ^ LENGTH(32); (x, x') \<in> word_nat_rel; (y, y') \<in> word_nat_rel; (xa, x'a) \<in> ?R'4; case xa of (S, xa, y) \<Rightarrow> 0 < xa; case x'a of (S, xa, y) \<Rightarrow> 0 < xa; x2 = (x1a, x2a); x'a = (x1, x2); x2b = (x1c, x2c); xa = (x1b, x2b); x2a < x' + y'\<rbrakk> \<Longrightarrow> ((x1b \<union> {x2c}, x1c - 1, x2c + 1), x1 \<union> {x2a}, x1a - 1, x2a + 1) \<in> ?R'4
 4. \<And>xa x'a x1 x2 x1a x2a x1b x2b x1c x2c. \<lbrakk>x' + y' < 2 ^ LENGTH(32); (x, x') \<in> word_nat_rel; (y, y') \<in> word_nat_rel; (xa, x'a) \<in> ?R'4; x2 = (x1a, x2a); x'a = (x1, x2); x2b = (x1c, x2c); xa = (x1b, x2b)\<rbrakk> \<Longrightarrow> (x1b, x1) \<in> \<langle>word_nat_rel\<rangle>set_rel
[PROOF STEP]
apply (refine_dref_type)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>x' + y' < 2 ^ LENGTH(32); (x, x') \<in> word_nat_rel; (y, y') \<in> word_nat_rel\<rbrakk> \<Longrightarrow> (({}, x, y), {}, x', y') \<in> \<langle>word_nat_rel\<rangle>set_rel \<times>\<^sub>r word_nat_rel \<times>\<^sub>r word_nat_rel
 2. \<And>xa x'a x1 x2 x1a x2a x1b x2b x1c x2c. \<lbrakk>x' + y' < 2 ^ LENGTH(32); (x, x') \<in> word_nat_rel; (y, y') \<in> word_nat_rel; (xa, x'a) \<in> \<langle>word_nat_rel\<rangle>set_rel \<times>\<^sub>r word_nat_rel \<times>\<^sub>r word_nat_rel; x2 = (x1a, x2a); xa = (x1, x2); x2b = (x1c, x2c); x'a = (x1b, x2b)\<rbrakk> \<Longrightarrow> (0 < x1a) = (0 < x1c)
 3. \<And>xa x'a x1 x2 x1a x2a x1b x2b x1c x2c. \<lbrakk>x' + y' < 2 ^ LENGTH(32); (x, x') \<in> word_nat_rel; (y, y') \<in> word_nat_rel; (xa, x'a) \<in> \<langle>word_nat_rel\<rangle>set_rel \<times>\<^sub>r word_nat_rel \<times>\<^sub>r word_nat_rel; case xa of (S, xa, y) \<Rightarrow> 0 < xa; case x'a of (S, xa, y) \<Rightarrow> 0 < xa; x2 = (x1a, x2a); x'a = (x1, x2); x2b = (x1c, x2c); xa = (x1b, x2b); x2a < x' + y'\<rbrakk> \<Longrightarrow> ((x1b \<union> {x2c}, x1c - 1, x2c + 1), x1 \<union> {x2a}, x1a - 1, x2a + 1) \<in> \<langle>word_nat_rel\<rangle>set_rel \<times>\<^sub>r word_nat_rel \<times>\<^sub>r word_nat_rel
 4. \<And>xa x'a x1 x2 x1a x2a x1b x2b x1c x2c. \<lbrakk>x' + y' < 2 ^ LENGTH(32); (x, x') \<in> word_nat_rel; (y, y') \<in> word_nat_rel; (xa, x'a) \<in> \<langle>word_nat_rel\<rangle>set_rel \<times>\<^sub>r word_nat_rel \<times>\<^sub>r word_nat_rel; x2 = (x1a, x2a); x'a = (x1, x2); x2b = (x1c, x2c); xa = (x1b, x2b)\<rbrakk> \<Longrightarrow> (x1b, x1) \<in> \<langle>word_nat_rel\<rangle>set_rel
[PROOF STEP]
apply (auto simp: refine_hsimp refine_rel_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
test_impl x y \<le> \<Down> (\<langle>word_nat_rel\<rangle>set_rel) (test x' y')

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma new_character_data_get_child_nodes_is_l_new_character_data_get_child_nodes [instances]:
  "l_new_character_data_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_new_character_data_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs
[PROOF STEP]
using new_character_data_is_l_new_character_data get_child_nodes_is_l_get_child_nodes
[PROOF STATE]
proof (prove)
using this:
l_new_character_data DocumentClass.type_wf
l_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs

goal (1 subgoal):
 1. l_new_character_data_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs
[PROOF STEP]
apply(simp add: l_new_character_data_get_child_nodes_def l_new_character_data_get_child_nodes_axioms_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>l_new_character_data DocumentClass.type_wf; l_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs\<rbrakk> \<Longrightarrow> l_new_character_data DocumentClass.type_wf \<and> l_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs \<and> (\<forall>ptr' new_character_data_ptr. ptr' \<noteq> cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h'. h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r. r \<in> get_child_nodes_locs ptr' \<longrightarrow> r h h')))) \<and> (\<forall>h new_character_data_ptr. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h'. h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> h' \<turnstile> get_child_nodes (cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr) \<rightarrow>\<^sub>r []))
[PROOF STEP]
using get_child_nodes_new_character_data new_character_data_no_child_nodes
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?ptr' \<noteq> cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?new_character_data_ptr; ?h \<turnstile> new_character_data \<rightarrow>\<^sub>r ?new_character_data_ptr; ?h \<turnstile> new_character_data \<rightarrow>\<^sub>h ?h'; ?r \<in> get_child_nodes_locs ?ptr'\<rbrakk> \<Longrightarrow> ?r ?h ?h'
\<lbrakk>?h \<turnstile> new_character_data \<rightarrow>\<^sub>r ?new_character_data_ptr; ?h \<turnstile> new_character_data \<rightarrow>\<^sub>h ?h'\<rbrakk> \<Longrightarrow> ?h' \<turnstile> get_child_nodes (cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?new_character_data_ptr) \<rightarrow>\<^sub>r []

goal (1 subgoal):
 1. \<lbrakk>l_new_character_data DocumentClass.type_wf; l_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs\<rbrakk> \<Longrightarrow> l_new_character_data DocumentClass.type_wf \<and> l_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs \<and> (\<forall>ptr' new_character_data_ptr. ptr' \<noteq> cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h'. h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r. r \<in> get_child_nodes_locs ptr' \<longrightarrow> r h h')))) \<and> (\<forall>h new_character_data_ptr. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h'. h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> h' \<turnstile> get_child_nodes (cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr) \<rightarrow>\<^sub>r []))
[PROOF STEP]
by fast


[STATEMENT]
lemma remainder_theorem_expression:
  assumes f [simp]: "f \<in> carrier P" and a [simp]: "a \<in> carrier R"
  and q [simp]: "q \<in> carrier P" and r [simp]: "r \<in> carrier P"
  and R_not_trivial: "carrier R \<noteq> {\<zero>}"
  and f_expr: "f = (monom P \<one>\<^bsub>R\<^esub> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r"
  (is "f = ?g \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r" is "f = ?gq \<oplus>\<^bsub>P\<^esub> r")
    and deg_r_0: "deg R r = 0"
    shows "r = monom P (eval R R id a f) 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
interpret UP_pre_univ_prop R R id P
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UP_pre_univ_prop R R id &&& P \<equiv> UP R
[PROOF STEP]
by standard simp
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
have eval_ring_hom: "eval R R id a \<in> ring_hom P R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval R R id a \<in> ring_hom P R
[PROOF STEP]
using eval_ring_hom [OF a]
[PROOF STATE]
proof (prove)
using this:
eval R R id a \<in> ring_hom P R

goal (1 subgoal):
 1. eval R R id a \<in> ring_hom P R
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
eval R R id a \<in> ring_hom P R

goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
have "eval R R id a f = eval R R id a ?gq \<oplus>\<^bsub>R\<^esub> eval R R id a r"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval R R id a f = eval R R id a ((monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q) \<oplus> eval R R id a r
[PROOF STEP]
unfolding f_expr
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval R R id a ((monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r) = eval R R id a ((monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q) \<oplus> eval R R id a r
[PROOF STEP]
using ring_hom_add [OF eval_ring_hom]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?x \<in> carrier P; ?y \<in> carrier P\<rbrakk> \<Longrightarrow> eval R R id a (?x \<oplus>\<^bsub>P\<^esub> ?y) = eval R R id a ?x \<oplus> eval R R id a ?y

goal (1 subgoal):
 1. eval R R id a ((monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q \<oplus>\<^bsub>P\<^esub> r) = eval R R id a ((monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q) \<oplus> eval R R id a r
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
eval R R id a f = eval R R id a ((monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q) \<oplus> eval R R id a r

goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
eval R R id a f = eval R R id a ((monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q) \<oplus> eval R R id a r

goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
have "\<dots> = ((eval R R id a ?g) \<otimes> (eval R R id a q)) \<oplus>\<^bsub>R\<^esub> eval R R id a r"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval R R id a ((monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q) \<oplus> eval R R id a r = eval R R id a (monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes> eval R R id a q \<oplus> eval R R id a r
[PROOF STEP]
using ring_hom_mult [OF eval_ring_hom]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?x \<in> carrier P; ?y \<in> carrier P\<rbrakk> \<Longrightarrow> eval R R id a (?x \<otimes>\<^bsub>P\<^esub> ?y) = eval R R id a ?x \<otimes> eval R R id a ?y

goal (1 subgoal):
 1. eval R R id a ((monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q) \<oplus> eval R R id a r = eval R R id a (monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes> eval R R id a q \<oplus> eval R R id a r
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
eval R R id a ((monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q) \<oplus> eval R R id a r = eval R R id a (monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes> eval R R id a q \<oplus> eval R R id a r

goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
eval R R id a ((monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes>\<^bsub>P\<^esub> q) \<oplus> eval R R id a r = eval R R id a (monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes> eval R R id a q \<oplus> eval R R id a r

goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
have "\<dots> = \<zero> \<oplus> eval R R id a r"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval R R id a (monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes> eval R R id a q \<oplus> eval R R id a r = \<zero> \<oplus> eval R R id a r
[PROOF STEP]
unfolding eval_monom_expr [OF a]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<zero> \<otimes> eval R R id a q \<oplus> eval R R id a r = \<zero> \<oplus> eval R R id a r
[PROOF STEP]
using eval_ring_hom
[PROOF STATE]
proof (prove)
using this:
eval R R id a \<in> ring_hom P R

goal (1 subgoal):
 1. \<zero> \<otimes> eval R R id a q \<oplus> eval R R id a r = \<zero> \<oplus> eval R R id a r
[PROOF STEP]
unfolding ring_hom_def
[PROOF STATE]
proof (prove)
using this:
eval R R id a \<in> {h \<in> carrier P \<rightarrow> carrier R. (\<forall>x y. x \<in> carrier P \<and> y \<in> carrier P \<longrightarrow> h (x \<otimes>\<^bsub>P\<^esub> y) = h x \<otimes> h y \<and> h (x \<oplus>\<^bsub>P\<^esub> y) = h x \<oplus> h y) \<and> h \<one>\<^bsub>P\<^esub> = \<one>}

goal (1 subgoal):
 1. \<zero> \<otimes> eval R R id a q \<oplus> eval R R id a r = \<zero> \<oplus> eval R R id a r
[PROOF STEP]
using q
[PROOF STATE]
proof (prove)
using this:
eval R R id a \<in> {h \<in> carrier P \<rightarrow> carrier R. (\<forall>x y. x \<in> carrier P \<and> y \<in> carrier P \<longrightarrow> h (x \<otimes>\<^bsub>P\<^esub> y) = h x \<otimes> h y \<and> h (x \<oplus>\<^bsub>P\<^esub> y) = h x \<oplus> h y) \<and> h \<one>\<^bsub>P\<^esub> = \<one>}
q \<in> carrier P

goal (1 subgoal):
 1. \<zero> \<otimes> eval R R id a q \<oplus> eval R R id a r = \<zero> \<oplus> eval R R id a r
[PROOF STEP]
unfolding Pi_def
[PROOF STATE]
proof (prove)
using this:
eval R R id a \<in> {h \<in> {f. \<forall>x. x \<in> carrier P \<longrightarrow> f x \<in> carrier R}. (\<forall>x y. x \<in> carrier P \<and> y \<in> carrier P \<longrightarrow> h (x \<otimes>\<^bsub>P\<^esub> y) = h x \<otimes> h y \<and> h (x \<oplus>\<^bsub>P\<^esub> y) = h x \<oplus> h y) \<and> h \<one>\<^bsub>P\<^esub> = \<one>}
q \<in> carrier P

goal (1 subgoal):
 1. \<zero> \<otimes> eval R R id a q \<oplus> eval R R id a r = \<zero> \<oplus> eval R R id a r
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
eval R R id a (monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes> eval R R id a q \<oplus> eval R R id a r = \<zero> \<oplus> eval R R id a r

goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
eval R R id a (monom P \<one> 1 \<ominus>\<^bsub>P\<^esub> monom P a 0) \<otimes> eval R R id a q \<oplus> eval R R id a r = \<zero> \<oplus> eval R R id a r

goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
have "\<dots> = eval R R id a r"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<zero> \<oplus> eval R R id a r = eval R R id a r
[PROOF STEP]
using eval_ring_hom
[PROOF STATE]
proof (prove)
using this:
eval R R id a \<in> ring_hom P R

goal (1 subgoal):
 1. \<zero> \<oplus> eval R R id a r = eval R R id a r
[PROOF STEP]
unfolding ring_hom_def
[PROOF STATE]
proof (prove)
using this:
eval R R id a \<in> {h \<in> carrier P \<rightarrow> carrier R. (\<forall>x y. x \<in> carrier P \<and> y \<in> carrier P \<longrightarrow> h (x \<otimes>\<^bsub>P\<^esub> y) = h x \<otimes> h y \<and> h (x \<oplus>\<^bsub>P\<^esub> y) = h x \<oplus> h y) \<and> h \<one>\<^bsub>P\<^esub> = \<one>}

goal (1 subgoal):
 1. \<zero> \<oplus> eval R R id a r = eval R R id a r
[PROOF STEP]
using r
[PROOF STATE]
proof (prove)
using this:
eval R R id a \<in> {h \<in> carrier P \<rightarrow> carrier R. (\<forall>x y. x \<in> carrier P \<and> y \<in> carrier P \<longrightarrow> h (x \<otimes>\<^bsub>P\<^esub> y) = h x \<otimes> h y \<and> h (x \<oplus>\<^bsub>P\<^esub> y) = h x \<oplus> h y) \<and> h \<one>\<^bsub>P\<^esub> = \<one>}
r \<in> carrier P

goal (1 subgoal):
 1. \<zero> \<oplus> eval R R id a r = eval R R id a r
[PROOF STEP]
unfolding Pi_def
[PROOF STATE]
proof (prove)
using this:
eval R R id a \<in> {h \<in> {f. \<forall>x. x \<in> carrier P \<longrightarrow> f x \<in> carrier R}. (\<forall>x y. x \<in> carrier P \<and> y \<in> carrier P \<longrightarrow> h (x \<otimes>\<^bsub>P\<^esub> y) = h x \<otimes> h y \<and> h (x \<oplus>\<^bsub>P\<^esub> y) = h x \<oplus> h y) \<and> h \<one>\<^bsub>P\<^esub> = \<one>}
r \<in> carrier P

goal (1 subgoal):
 1. \<zero> \<oplus> eval R R id a r = eval R R id a r
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<zero> \<oplus> eval R R id a r = eval R R id a r

goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
eval R R id a f = eval R R id a r
[PROOF STEP]
have eval_eq: "eval R R id a f = eval R R id a r"
[PROOF STATE]
proof (prove)
using this:
eval R R id a f = eval R R id a r

goal (1 subgoal):
 1. eval R R id a f = eval R R id a r
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
eval R R id a f = eval R R id a r

goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
from deg_zero_impl_monom [OF r deg_r_0]
[PROOF STATE]
proof (chain)
picking this:
r = monom P (coeff P r 0) 0
[PROOF STEP]
have "r = monom P (coeff P r 0) 0"
[PROOF STATE]
proof (prove)
using this:
r = monom P (coeff P r 0) 0

goal (1 subgoal):
 1. r = monom P (coeff P r 0) 0
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
r = monom P (coeff P r 0) 0

goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
with eval_const [OF a, of "coeff P r 0"] eval_eq
[PROOF STATE]
proof (chain)
picking this:
coeff P r 0 \<in> carrier R \<Longrightarrow> eval R R id a (monom P (coeff P r 0) 0) = id (coeff P r 0)
eval R R id a f = eval R R id a r
r = monom P (coeff P r 0) 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
coeff P r 0 \<in> carrier R \<Longrightarrow> eval R R id a (monom P (coeff P r 0) 0) = id (coeff P r 0)
eval R R id a f = eval R R id a r
r = monom P (coeff P r 0) 0

goal (1 subgoal):
 1. r = monom P (eval R R id a f) 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
r = monom P (eval R R id a f) 0

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma PO_m3_DY_fake_refines_m2_fake:
  "{R23 \<inter> m2_inv3a_sesK_compr \<times> (m3_inv2_sesK_compr \<inter> m3_inv1_lkeysec)}
     m2_fake, m3_DY_fake
   {> R23}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {R23 \<inter> m2_inv3a_sesK_compr \<times> (m3_inv2_sesK_compr \<inter> m3_inv1_lkeysec)} m2_fake, m3_DY_fake {> R23}
[PROOF STEP]
apply (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros
            del: abs_msg.cases)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>a y x. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; a \<in> m2_inv3a_sesK_compr; y \<in> m3_inv2_sesK_compr; y \<in> m3_inv1_lkeysec; x \<in> abs_msg (parts (IK y))\<rbrakk> \<Longrightarrow> x \<in> fake ik0 (dom (runs a)) (chan a)
 2. \<And>a y x. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; a \<in> m2_inv3a_sesK_compr; y \<in> m3_inv2_sesK_compr; y \<in> m3_inv1_lkeysec; x \<in> abs_msg (synth (analz (IK y)))\<rbrakk> \<Longrightarrow> x \<in> fake ik0 (dom (runs a)) (chan a)
 3. \<And>a y KK K. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; a \<in> m2_inv3a_sesK_compr; y \<in> m3_inv2_sesK_compr; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Key K \<in> analz (Key ` KK \<union> IK y)\<rbrakk> \<Longrightarrow> aKey K \<in> extr (aKey ` KK \<union> ik0) (chan a)
 4. \<And>a y KK K. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; a \<in> m2_inv3a_sesK_compr; y \<in> m3_inv2_sesK_compr; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Key K \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aKey K \<in> extr (aKey ` KK \<union> ik0) (chan a)
 5. \<And>a y KK N. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; a \<in> m2_inv3a_sesK_compr; y \<in> m3_inv2_sesK_compr; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Nonce N \<in> analz (Key ` KK \<union> IK y)\<rbrakk> \<Longrightarrow> aNon N \<in> extr (aKey ` KK \<union> ik0) (chan a)
 6. \<And>a y KK N. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; a \<in> m2_inv3a_sesK_compr; y \<in> m3_inv2_sesK_compr; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Nonce N \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aNon N \<in> extr (aKey ` KK \<union> ik0) (chan a)
[PROOF STEP]
apply (auto intro: abs_msg_DY_subset_fakeable [THEN subsetD]
            del: abs_msg.cases)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a y KK K. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; a \<in> m2_inv3a_sesK_compr; y \<in> m3_inv2_sesK_compr; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Key K \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aKey K \<in> extr (aKey ` KK \<union> ik0) (chan a)
 2. \<And>a y KK N. \<lbrakk>(a, y) \<in> R23_msgs; (a, y) \<in> R23_keys; (a, y) \<in> R23_non; (a, y) \<in> R23_pres; a \<in> m2_inv3a_sesK_compr; y \<in> m3_inv2_sesK_compr; y \<in> m3_inv1_lkeysec; KK \<subseteq> range sesK; Nonce N \<in> analz (IK y)\<rbrakk> \<Longrightarrow> aNon N \<in> extr (aKey ` KK \<union> ik0) (chan a)
[PROOF STEP]
apply (auto simp add: R23_simps)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma OclAny_allInstances_generic_oclIsTypeOf\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y1:
assumes [simp]: "\<And>x. pre_post (x, x) = x"
shows "\<exists>\<tau>. (\<tau> \<Turnstile>     ((OclAllInstances_generic pre_post OclAny)->forAll\<^sub>S\<^sub>e\<^sub>t(X|X .oclIsTypeOf(OclAny))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>\<tau>. \<tau> \<Turnstile> UML_Set.OclForall (OclAllInstances_generic pre_post OclAny) OclIsTypeOf\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y
[PROOF STEP]
apply(rule_tac x = \<tau>\<^sub>0 in exI, simp add: \<tau>\<^sub>0_def OclValid_def del: OclAllInstances_generic_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UML_Set.OclForall (OclAllInstances_generic pre_post OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA>) OclIsTypeOf\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = \<lfloor>\<lfloor>True\<rfloor>\<rfloor>
[PROOF STEP]
apply(simp only: assms UML_Set.OclForall_def refl if_True
                  OclAllInstances_generic_defined[simplified OclValid_def])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else true (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>)) = \<lfloor>\<lfloor>True\<rfloor>\<rfloor>
[PROOF STEP]
apply(simp only: OclAllInstances_generic_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else true (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>)) = \<lfloor>\<lfloor>True\<rfloor>\<rfloor>
[PROOF STEP]
apply(subst (1 2 3) Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e_inverse, simp add: bot_option_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else true (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>)) = \<lfloor>\<lfloor>True\<rfloor>\<rfloor>
[PROOF STEP]
by(simp add: OclIsTypeOf\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_OclAny)


[STATEMENT]
lemma "(Q::'a \<Rightarrow> bool) \<noteq> bot \<Longrightarrow> (Q::'a \<Rightarrow> bool) (Eps Q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Q \<noteq> bot \<Longrightarrow> Q (Eps Q)
[PROOF STEP]
nitpick [expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Q \<noteq> bot \<Longrightarrow> Q (Eps Q)
[PROOF STEP]
sorry


[STATEMENT]
lemma ABinds_restr_subst:
  assumes "\<And> x' e a. (x',e) \<in> set \<Gamma> \<Longrightarrow> Aexp e[x::=y]\<cdot>a f|` S = Aexp e\<cdot>a f|` S"
  assumes "x \<notin> S"
  assumes "y \<notin> S"
  assumes "domA \<Gamma> \<subseteq> S"
  shows "ABinds \<Gamma>[x::h=y]\<cdot>ae f|` S = ABinds \<Gamma>\<cdot>(ae  f|` S) f|` S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ABinds \<Gamma>[x::h=y]\<cdot>ae f|` S = ABinds \<Gamma>\<cdot>(ae f|` S) f|` S
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
(?x', ?e) \<in> set \<Gamma> \<Longrightarrow> \<A>\<^bsub>?a\<^esub> ?e[x::=y] f|` S = \<A>\<^bsub>?a\<^esub> ?e f|` S
x \<notin> S
y \<notin> S
domA \<Gamma> \<subseteq> S

goal (1 subgoal):
 1. ABinds \<Gamma>[x::h=y]\<cdot>ae f|` S = ABinds \<Gamma>\<cdot>(ae f|` S) f|` S
[PROOF STEP]
apply (induction \<Gamma> rule:ABinds.induct)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<And>x' e a. (x', e) \<in> set [] \<Longrightarrow> \<A>\<^bsub>a\<^esub> e[x::=y] f|` S = \<A>\<^bsub>a\<^esub> e f|` S; x \<notin> S; y \<notin> S; domA [] \<subseteq> S\<rbrakk> \<Longrightarrow> ABinds [][x::h=y]\<cdot>ae f|` S = ABinds []\<cdot>(ae f|` S) f|` S
 2. \<And>v e binds. \<lbrakk>\<lbrakk>\<And>x' e a. (x', e) \<in> set (delete v binds) \<Longrightarrow> \<A>\<^bsub>a\<^esub> e[x::=y] f|` S = \<A>\<^bsub>a\<^esub> e f|` S; x \<notin> S; y \<notin> S; domA (delete v binds) \<subseteq> S\<rbrakk> \<Longrightarrow> ABinds (delete v binds)[x::h=y]\<cdot>ae f|` S = ABinds (delete v binds)\<cdot>(ae f|` S) f|` S; \<And>x' ea a. (x', ea) \<in> set ((v, e) # binds) \<Longrightarrow> \<A>\<^bsub>a\<^esub> ea[x::=y] f|` S = \<A>\<^bsub>a\<^esub> ea f|` S; x \<notin> S; y \<notin> S; domA ((v, e) # binds) \<subseteq> S\<rbrakk> \<Longrightarrow> ABinds ((v, e) # binds)[x::h=y]\<cdot>ae f|` S = ABinds ((v, e) # binds)\<cdot>(ae f|` S) f|` S
[PROOF STEP]
apply (auto simp del: fun_meet_simp join_comm simp add: env_restr_join)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>v e binds. \<lbrakk>\<lbrakk>\<And>x' e a. (x', e) \<in> set (delete v binds) \<Longrightarrow> \<A>\<^bsub>a\<^esub> e[x::=y] f|` S = \<A>\<^bsub>a\<^esub> e f|` S; domA binds - {v} \<subseteq> S\<rbrakk> \<Longrightarrow> ABinds (delete v binds[x::h=y])\<cdot>ae f|` S = ABinds (delete v binds)\<cdot>(ae f|` S) f|` S; \<And>x' ea a. x' = v \<and> ea = e \<or> (x', ea) \<in> set binds \<Longrightarrow> \<A>\<^bsub>a\<^esub> ea[x::=y] f|` S = \<A>\<^bsub>a\<^esub> ea f|` S; x \<notin> S; y \<notin> S; v \<in> S; domA binds \<subseteq> S\<rbrakk> \<Longrightarrow> \<A>\<^sup>\<bottom>\<^bsub>ae v\<^esub> e[x::=y] f|` S \<squnion> ABinds (delete v binds[x::h=y])\<cdot>ae f|` S = \<A>\<^sup>\<bottom>\<^bsub>ae v\<^esub> e f|` S \<squnion> ABinds (delete v binds)\<cdot>(ae f|` S) f|` S
[PROOF STEP]
apply (rule arg_cong2[where f = join])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>v e binds. \<lbrakk>\<lbrakk>\<And>x' e a. (x', e) \<in> set (delete v binds) \<Longrightarrow> \<A>\<^bsub>a\<^esub> e[x::=y] f|` S = \<A>\<^bsub>a\<^esub> e f|` S; domA binds - {v} \<subseteq> S\<rbrakk> \<Longrightarrow> ABinds (delete v binds[x::h=y])\<cdot>ae f|` S = ABinds (delete v binds)\<cdot>(ae f|` S) f|` S; \<And>x' ea a. x' = v \<and> ea = e \<or> (x', ea) \<in> set binds \<Longrightarrow> \<A>\<^bsub>a\<^esub> ea[x::=y] f|` S = \<A>\<^bsub>a\<^esub> ea f|` S; x \<notin> S; y \<notin> S; v \<in> S; domA binds \<subseteq> S\<rbrakk> \<Longrightarrow> \<A>\<^sup>\<bottom>\<^bsub>ae v\<^esub> e[x::=y] f|` S = \<A>\<^sup>\<bottom>\<^bsub>ae v\<^esub> e f|` S
 2. \<And>v e binds. \<lbrakk>\<lbrakk>\<And>x' e a. (x', e) \<in> set (delete v binds) \<Longrightarrow> \<A>\<^bsub>a\<^esub> e[x::=y] f|` S = \<A>\<^bsub>a\<^esub> e f|` S; domA binds - {v} \<subseteq> S\<rbrakk> \<Longrightarrow> ABinds (delete v binds[x::h=y])\<cdot>ae f|` S = ABinds (delete v binds)\<cdot>(ae f|` S) f|` S; \<And>x' ea a. x' = v \<and> ea = e \<or> (x', ea) \<in> set binds \<Longrightarrow> \<A>\<^bsub>a\<^esub> ea[x::=y] f|` S = \<A>\<^bsub>a\<^esub> ea f|` S; x \<notin> S; y \<notin> S; v \<in> S; domA binds \<subseteq> S\<rbrakk> \<Longrightarrow> ABinds (delete v binds[x::h=y])\<cdot>ae f|` S = ABinds (delete v binds)\<cdot>(ae f|` S) f|` S
[PROOF STEP]
apply (case_tac "ae v")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>v e binds. \<lbrakk>\<lbrakk>\<And>x' e a. (x', e) \<in> set (delete v binds) \<Longrightarrow> \<A>\<^bsub>a\<^esub> e[x::=y] f|` S = \<A>\<^bsub>a\<^esub> e f|` S; domA binds - {v} \<subseteq> S\<rbrakk> \<Longrightarrow> ABinds (delete v binds[x::h=y])\<cdot>ae f|` S = ABinds (delete v binds)\<cdot>(ae f|` S) f|` S; \<And>x' ea a. x' = v \<and> ea = e \<or> (x', ea) \<in> set binds \<Longrightarrow> \<A>\<^bsub>a\<^esub> ea[x::=y] f|` S = \<A>\<^bsub>a\<^esub> ea f|` S; x \<notin> S; y \<notin> S; v \<in> S; domA binds \<subseteq> S; ae v = \<bottom>\<rbrakk> \<Longrightarrow> \<A>\<^sup>\<bottom>\<^bsub>ae v\<^esub> e[x::=y] f|` S = \<A>\<^sup>\<bottom>\<^bsub>ae v\<^esub> e f|` S
 2. \<And>v e binds xa. \<lbrakk>\<lbrakk>\<And>x' e a. (x', e) \<in> set (delete v binds) \<Longrightarrow> \<A>\<^bsub>a\<^esub> e[x::=y] f|` S = \<A>\<^bsub>a\<^esub> e f|` S; domA binds - {v} \<subseteq> S\<rbrakk> \<Longrightarrow> ABinds (delete v binds[x::h=y])\<cdot>ae f|` S = ABinds (delete v binds)\<cdot>(ae f|` S) f|` S; \<And>x' ea a. x' = v \<and> ea = e \<or> (x', ea) \<in> set binds \<Longrightarrow> \<A>\<^bsub>a\<^esub> ea[x::=y] f|` S = \<A>\<^bsub>a\<^esub> ea f|` S; x \<notin> S; y \<notin> S; v \<in> S; domA binds \<subseteq> S; ae v = up\<cdot>xa\<rbrakk> \<Longrightarrow> \<A>\<^sup>\<bottom>\<^bsub>ae v\<^esub> e[x::=y] f|` S = \<A>\<^sup>\<bottom>\<^bsub>ae v\<^esub> e f|` S
 3. \<And>v e binds. \<lbrakk>\<lbrakk>\<And>x' e a. (x', e) \<in> set (delete v binds) \<Longrightarrow> \<A>\<^bsub>a\<^esub> e[x::=y] f|` S = \<A>\<^bsub>a\<^esub> e f|` S; domA binds - {v} \<subseteq> S\<rbrakk> \<Longrightarrow> ABinds (delete v binds[x::h=y])\<cdot>ae f|` S = ABinds (delete v binds)\<cdot>(ae f|` S) f|` S; \<And>x' ea a. x' = v \<and> ea = e \<or> (x', ea) \<in> set binds \<Longrightarrow> \<A>\<^bsub>a\<^esub> ea[x::=y] f|` S = \<A>\<^bsub>a\<^esub> ea f|` S; x \<notin> S; y \<notin> S; v \<in> S; domA binds \<subseteq> S\<rbrakk> \<Longrightarrow> ABinds (delete v binds[x::h=y])\<cdot>ae f|` S = ABinds (delete v binds)\<cdot>(ae f|` S) f|` S
[PROOF STEP]
apply (auto dest:  subsetD[OF set_delete_subset])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma tr'_par_sem_equiv:
  assumes "\<forall>(l,t,s) \<in> set D. (fv t \<union> fv s) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (unlabel A) = {}"
  and "fv\<^sub>s\<^sub>s\<^sub>t (unlabel A) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (unlabel A) = {}" "ground M"
  and "\<forall>(i,p) \<in> setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D. \<forall>(j,q) \<in> setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D.
        (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j" (is "?R A D")
  and \<I>: "interpretation\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<I>"
  shows "\<lbrakk>M; set (unlabel D) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \<I>; unlabel A\<rbrakk>\<^sub>s \<I> \<longleftrightarrow> (\<exists>B \<in> set (tr'\<^sub>p\<^sub>c A D). \<lbrakk>M; unlabel B\<rbrakk>\<^sub>d \<I>)"
        (is "?P \<longleftrightarrow> ?Q")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>M; set (unlabel D) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \<I>; unlabel A\<rbrakk>\<^sub>s \<I> = (\<exists>B\<in>set (tr'\<^sub>p\<^sub>c A D). \<lbrakk>M; unlabel B\<rbrakk>\<^sub>d \<I>)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>M; set (unlabel D) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \<I>; unlabel A\<rbrakk>\<^sub>s \<I> = (\<exists>B\<in>set (tr'\<^sub>p\<^sub>c A D). \<lbrakk>M; unlabel B\<rbrakk>\<^sub>d \<I>)
[PROOF STEP]
have 1: "\<forall>(t,s) \<in> set (unlabel D). (fv t \<union> fv s) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (unlabel A) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>(t, s)\<in>set (unlabel D). (fv t \<union> fv s) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t A = {}
[PROOF STEP]
using assms(1)
[PROOF STATE]
proof (prove)
using this:
\<forall>(l, t, s)\<in>set D. (fv t \<union> fv s) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t A = {}

goal (1 subgoal):
 1. \<forall>(t, s)\<in>set (unlabel D). (fv t \<union> fv s) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t A = {}
[PROOF STEP]
unfolding unlabel_def
[PROOF STATE]
proof (prove)
using this:
\<forall>(l, t, s)\<in>set D. (fv t \<union> fv s) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (map snd A) = {}

goal (1 subgoal):
 1. \<forall>(t, s)\<in>set (map snd D). (fv t \<union> fv s) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (map snd A) = {}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
\<forall>(t, s)\<in>set (unlabel D). (fv t \<union> fv s) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t A = {}

goal (1 subgoal):
 1. \<lbrakk>M; set (unlabel D) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \<I>; unlabel A\<rbrakk>\<^sub>s \<I> = (\<exists>B\<in>set (tr'\<^sub>p\<^sub>c A D). \<lbrakk>M; unlabel B\<rbrakk>\<^sub>d \<I>)
[PROOF STEP]
have 2: "\<forall>(i,p) \<in> setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D. \<forall>(j,q) \<in> setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D. p = q \<longrightarrow> i = j"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D. p = q \<longrightarrow> i = j
[PROOF STEP]
using assms(4) subst_apply_term_empty
[PROOF STATE]
proof (prove)
using this:
\<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D. (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j
?t \<cdot> Var = ?t

goal (1 subgoal):
 1. \<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D. p = q \<longrightarrow> i = j
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union> set D. p = q \<longrightarrow> i = j

goal (1 subgoal):
 1. \<lbrakk>M; set (unlabel D) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \<I>; unlabel A\<rbrakk>\<^sub>s \<I> = (\<exists>B\<in>set (tr'\<^sub>p\<^sub>c A D). \<lbrakk>M; unlabel B\<rbrakk>\<^sub>d \<I>)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>M; set (unlabel D) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \<I>; unlabel A\<rbrakk>\<^sub>s \<I> = (\<exists>B\<in>set (tr'\<^sub>p\<^sub>c A D). \<lbrakk>M; unlabel B\<rbrakk>\<^sub>d \<I>)
[PROOF STEP]
by (metis tr_sem_equiv'[OF 1 assms(2,3) \<I>] tr'_par_iff_unlabel_tr[OF 2])
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; set (unlabel D) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \<I>; unlabel A\<rbrakk>\<^sub>s \<I> = (\<exists>B\<in>set (tr'\<^sub>p\<^sub>c A D). \<lbrakk>M; unlabel B\<rbrakk>\<^sub>d \<I>)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Key_unique_SesKey:
     "\<lbrakk> Crypt K  \<lbrace>Key SesKey,  Agent B, T, Ticket\<rbrace>
           \<in> parts (spies evs);
         Crypt K' \<lbrace>Key SesKey,  Agent B', T', Ticket'\<rbrace>
           \<in> parts (spies evs);  Key SesKey \<notin> analz (spies evs);
         evs \<in> kerbIV \<rbrakk>
      \<Longrightarrow> K=K' \<and> B=B' \<and> T=T' \<and> Ticket=Ticket'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs); Key SesKey \<notin> analz (knows Spy evs); evs \<in> kerbIV\<rbrakk> \<Longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs); Key SesKey \<notin> analz (knows Spy evs); evs \<in> kerbIV\<rbrakk> \<Longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Key SesKey \<notin> analz (knows Spy evs); evs \<in> kerbIV\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. evs \<in> kerbIV \<Longrightarrow> Key SesKey \<notin> analz (knows Spy evs) \<longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
[PROOF STEP]
apply (erule kerbIV.induct, analz_mono_contra)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. Key SesKey \<notin> analz (knows Spy []) \<longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy []) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy []) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 2. \<And>evsf X Ba. \<lbrakk>evsf \<in> kerbIV; X \<in> synth (analz (knows Spy evsf)); Key SesKey \<notin> analz (knows Spy evsf); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says Spy Ba X # evsf)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says Spy Ba X # evsf)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 3. \<And>evs1 A. \<lbrakk>evs1 \<in> kerbIV; Key SesKey \<notin> analz (knows Spy evs1); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 4. \<And>evs2 authK A' A T1. \<lbrakk>evs2 \<in> kerbIV; Key authK \<notin> used evs2; authK \<in> symKeys; Says A' Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs2; Key SesKey \<notin> analz (knows Spy evs2); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number (CT evs2), Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace>\<rbrace>) # evs2)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number (CT evs2), Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace>\<rbrace>) # evs2)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 5. \<And>evs3 A T1 Kas' authK Ta authTicket Ba. \<lbrakk>evs3 \<in> kerbIV; Says A Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs3; Says Kas' A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evs3; valid Ta wrt T1; Key SesKey \<notin> analz (knows Spy evs3); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says A Tgs \<lbrace>authTicket, Crypt authK \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent Ba\<rbrace> # evs3)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says A Tgs \<lbrace>authTicket, Crypt authK \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent Ba\<rbrace> # evs3)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 6. \<And>evs4 servK Ba authK A' A Ta T2. \<lbrakk>evs4 \<in> kerbIV; Key servK \<notin> used evs4; servK \<in> symKeys; Ba \<noteq> Tgs; authK \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>, Crypt authK \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredAK Ta evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key SesKey \<notin> analz (knows Spy evs4); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says Tgs A (Crypt authK \<lbrace>Key servK, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace>\<rbrace>) # evs4)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says Tgs A (Crypt authK \<lbrace>Key servK, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace>\<rbrace>) # evs4)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 7. \<And>evs5 authK servK A authTicket T2 Ba Tgs' Ts servTicket. \<lbrakk>evs5 \<in> kerbIV; authK \<in> symKeys; servK \<in> symKeys; Says A Tgs \<lbrace>authTicket, Crypt authK \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs5; Says Tgs' A (Crypt authK \<lbrace>Key servK, Agent Ba, Number Ts, servTicket\<rbrace>) \<in> set evs5; valid Ts wrt T2; Key SesKey \<notin> analz (knows Spy evs5); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs5) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs5) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says A Ba \<lbrace>servTicket, Crypt servK \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says A Ba \<lbrace>servTicket, Crypt servK \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 8. \<And>evs6 A' Ba A servK Ts T3. \<lbrakk>evs6 \<in> kerbIV; Says A' Ba \<lbrace>Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number Ts\<rbrace>, Crypt servK \<lbrace>Agent A, Number T3\<rbrace>\<rbrace> \<in> set evs6; \<not> expiredSK Ts evs6; \<not> expiredA T3 evs6; Key SesKey \<notin> analz (knows Spy evs6); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs6) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs6) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says Ba A (Crypt servK (Number T3)) # evs6)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says Ba A (Crypt servK (Number T3)) # evs6)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 9. \<And>evsO1 A authK Ta authTicket. \<lbrakk>evsO1 \<in> kerbIV; A \<noteq> Spy; Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evsO1; expiredAK Ta evsO1; Key SesKey \<notin> analz (knows Spy evsO1); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evsO1) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evsO1) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authK\<rbrace> # evsO1)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authK\<rbrace> # evsO1)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 10. \<And>evsO2 A authK servK Ba Ts servTicket. \<lbrakk>evsO2 \<in> kerbIV; A \<noteq> Spy; Says Tgs A (Crypt authK \<lbrace>Key servK, Agent Ba, Number Ts, servTicket\<rbrace>) \<in> set evsO2; expiredSK Ts evsO2; Key SesKey \<notin> analz (knows Spy evsO2); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evsO2) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evsO2) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Ba, Number Ts, Key servK\<rbrace> # evsO2)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Ba, Number Ts, Key servK\<rbrace> # evsO2)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
[PROOF STEP]
apply (frule_tac [7] K5_msg_in_parts_spies)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. Key SesKey \<notin> analz (knows Spy []) \<longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy []) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy []) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 2. \<And>evsf X Ba. \<lbrakk>evsf \<in> kerbIV; X \<in> synth (analz (knows Spy evsf)); Key SesKey \<notin> analz (knows Spy evsf); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says Spy Ba X # evsf)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says Spy Ba X # evsf)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 3. \<And>evs1 A. \<lbrakk>evs1 \<in> kerbIV; Key SesKey \<notin> analz (knows Spy evs1); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 4. \<And>evs2 authK A' A T1. \<lbrakk>evs2 \<in> kerbIV; Key authK \<notin> used evs2; authK \<in> symKeys; Says A' Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs2; Key SesKey \<notin> analz (knows Spy evs2); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number (CT evs2), Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace>\<rbrace>) # evs2)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number (CT evs2), Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace>\<rbrace>) # evs2)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 5. \<And>evs3 A T1 Kas' authK Ta authTicket Ba. \<lbrakk>evs3 \<in> kerbIV; Says A Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs3; Says Kas' A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evs3; valid Ta wrt T1; Key SesKey \<notin> analz (knows Spy evs3); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says A Tgs \<lbrace>authTicket, Crypt authK \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent Ba\<rbrace> # evs3)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says A Tgs \<lbrace>authTicket, Crypt authK \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent Ba\<rbrace> # evs3)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 6. \<And>evs4 servK Ba authK A' A Ta T2. \<lbrakk>evs4 \<in> kerbIV; Key servK \<notin> used evs4; servK \<in> symKeys; Ba \<noteq> Tgs; authK \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>, Crypt authK \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredAK Ta evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key SesKey \<notin> analz (knows Spy evs4); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says Tgs A (Crypt authK \<lbrace>Key servK, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace>\<rbrace>) # evs4)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says Tgs A (Crypt authK \<lbrace>Key servK, Agent Ba, Number (CT evs4), Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace>\<rbrace>) # evs4)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 7. \<And>evs5 authK servK A authTicket T2 Ba Tgs' Ts servTicket. \<lbrakk>evs5 \<in> kerbIV; authK \<in> symKeys; servK \<in> symKeys; Says A Tgs \<lbrace>authTicket, Crypt authK \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs5; Says Tgs' A (Crypt authK \<lbrace>Key servK, Agent Ba, Number Ts, servTicket\<rbrace>) \<in> set evs5; valid Ts wrt T2; Key SesKey \<notin> analz (knows Spy evs5); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs5) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs5) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'; servTicket \<in> parts (knows Spy evs5)\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says A Ba \<lbrace>servTicket, Crypt servK \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says A Ba \<lbrace>servTicket, Crypt servK \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 8. \<And>evs6 A' Ba A servK Ts T3. \<lbrakk>evs6 \<in> kerbIV; Says A' Ba \<lbrace>Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number Ts\<rbrace>, Crypt servK \<lbrace>Agent A, Number T3\<rbrace>\<rbrace> \<in> set evs6; \<not> expiredSK Ts evs6; \<not> expiredA T3 evs6; Key SesKey \<notin> analz (knows Spy evs6); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs6) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs6) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says Ba A (Crypt servK (Number T3)) # evs6)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says Ba A (Crypt servK (Number T3)) # evs6)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 9. \<And>evsO1 A authK Ta authTicket. \<lbrakk>evsO1 \<in> kerbIV; A \<noteq> Spy; Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evsO1; expiredAK Ta evsO1; Key SesKey \<notin> analz (knows Spy evsO1); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evsO1) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evsO1) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authK\<rbrace> # evsO1)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authK\<rbrace> # evsO1)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 10. \<And>evsO2 A authK servK Ba Ts servTicket. \<lbrakk>evsO2 \<in> kerbIV; A \<noteq> Spy; Says Tgs A (Crypt authK \<lbrace>Key servK, Agent Ba, Number Ts, servTicket\<rbrace>) \<in> set evsO2; expiredSK Ts evsO2; Key SesKey \<notin> analz (knows Spy evsO2); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evsO2) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evsO2) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Ba, Number Ts, Key servK\<rbrace> # evsO2)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy (Says A Spy \<lbrace>Agent A, Agent Ba, Number Ts, Key servK\<rbrace> # evsO2)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
[PROOF STEP]
apply (frule_tac [5] K3_msg_in_parts_spies, simp_all)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>evsf X. \<lbrakk>evsf \<in> kerbIV; X \<in> synth (analz (knows Spy evsf)); Key SesKey \<notin> analz (knows Spy evsf); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (insert X (knows Spy evsf)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (insert X (knows Spy evsf)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 2. \<And>evs2 authK A' A T1. \<lbrakk>evs2 \<in> kerbIV; Key authK \<notin> used evs2; authK \<in> symKeys; Says A' Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs2; Key SesKey \<notin> analz (knows Spy evs2); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> (K' = shrK A \<and> SesKey = authK \<and> B' = Tgs \<and> T' = Number (CT evs2) \<and> Ticket' = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace> \<longrightarrow> Crypt K \<lbrace>Key authK, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> K = shrK A \<and> B = Tgs \<and> T = Number (CT evs2) \<and> Ticket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace>) \<and> (Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> K = shrK A \<and> SesKey = authK \<and> B = Tgs \<and> T = Number (CT evs2) \<and> Ticket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace> \<longrightarrow> shrK A = K' \<and> Tgs = B' \<and> Number (CT evs2) = T' \<and> Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace> = Ticket')
 3. \<And>evs4 servK Ba authK A' A Ta T2. \<lbrakk>evs4 \<in> kerbIV; Key servK \<notin> used evs4; servK \<in> symKeys; Ba \<noteq> Tgs; authK \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>, Crypt authK \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key SesKey \<notin> analz (knows Spy evs4); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> (K' = authK \<and> SesKey = servK \<and> B' = Ba \<and> T' = Number (CT evs4) \<and> Ticket' = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace> \<longrightarrow> Crypt K \<lbrace>Key servK, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> K = authK \<and> B = Ba \<and> T = Number (CT evs4) \<and> Ticket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace>) \<and> (Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> K = authK \<and> SesKey = servK \<and> B = Ba \<and> T = Number (CT evs4) \<and> Ticket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace> \<longrightarrow> authK = K' \<and> Ba = B' \<and> Number (CT evs4) = T' \<and> Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace> = Ticket')
[PROOF STEP]
txt\<open>Fake, K2, K4\<close>
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>evsf X. \<lbrakk>evsf \<in> kerbIV; X \<in> synth (analz (knows Spy evsf)); Key SesKey \<notin> analz (knows Spy evsf); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evsf) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (insert X (knows Spy evsf)) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (insert X (knows Spy evsf)) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'
 2. \<And>evs2 authK A' A T1. \<lbrakk>evs2 \<in> kerbIV; Key authK \<notin> used evs2; authK \<in> symKeys; Says A' Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs2; Key SesKey \<notin> analz (knows Spy evs2); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> (K' = shrK A \<and> SesKey = authK \<and> B' = Tgs \<and> T' = Number (CT evs2) \<and> Ticket' = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace> \<longrightarrow> Crypt K \<lbrace>Key authK, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> K = shrK A \<and> B = Tgs \<and> T = Number (CT evs2) \<and> Ticket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace>) \<and> (Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> K = shrK A \<and> SesKey = authK \<and> B = Tgs \<and> T = Number (CT evs2) \<and> Ticket = Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace> \<longrightarrow> shrK A = K' \<and> Tgs = B' \<and> Number (CT evs2) = T' \<and> Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace> = Ticket')
 3. \<And>evs4 servK Ba authK A' A Ta T2. \<lbrakk>evs4 \<in> kerbIV; Key servK \<notin> used evs4; servK \<in> symKeys; Ba \<noteq> Tgs; authK \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>, Crypt authK \<lbrace>Agent A, Number T2\<rbrace>, Agent Ba\<rbrace> \<in> set evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta; Key SesKey \<notin> analz (knows Spy evs4); Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> Crypt K \<lbrace>Key SesKey, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> K = K' \<and> B = B' \<and> T = T' \<and> Ticket = Ticket'\<rbrakk> \<Longrightarrow> (K' = authK \<and> SesKey = servK \<and> B' = Ba \<and> T' = Number (CT evs4) \<and> Ticket' = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace> \<longrightarrow> Crypt K \<lbrace>Key servK, Agent B, T, Ticket\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> K = authK \<and> B = Ba \<and> T = Number (CT evs4) \<and> Ticket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace>) \<and> (Crypt K' \<lbrace>Key SesKey, Agent B', T', Ticket'\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> K = authK \<and> SesKey = servK \<and> B = Ba \<and> T = Number (CT evs4) \<and> Ticket = Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace> \<longrightarrow> authK = K' \<and> Ba = B' \<and> Number (CT evs4) = T' \<and> Crypt (shrK Ba) \<lbrace>Agent A, Agent Ba, Key servK, Number (CT evs4)\<rbrace> = Ticket')
[PROOF STEP]
apply (blast+)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma sweep_loop_locs_fA_eq_locs:
  "sweep_loop_locs \<subseteq> fA_eq_locs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sweep_loop_locs \<subseteq> fA_eq_locs
[PROOF STEP]
apply (simp add: sweep_loop_locs_def fA_eq_locs_def sweep_locs_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prefixed ''sweep_loop'' \<subseteq> insert idle_load_fM (insert idle_invert_fM (prefixed ''idle_noop'' \<union> (mark_locs - {mark_load_fM, mark_store_fA, mark_noop_mfence}) \<union> prefixed ''sweep''))
[PROOF STEP]
apply (intro subset_insertI2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prefixed ''sweep_loop'' \<subseteq> prefixed ''idle_noop'' \<union> (mark_locs - {mark_load_fM, mark_store_fA, mark_noop_mfence}) \<union> prefixed ''sweep''
[PROOF STEP]
apply (auto intro: append_prefixD)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma get_M_is_l_get_M: "l_get_M get\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t type_wf shadow_root_ptr_kinds"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_get_M get ShadowRootClass.type_wf shadow_root_ptr_kinds
[PROOF STEP]
apply(simp add: get\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_type_wf l_get_M_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>ptr h. (\<exists>y. get ptr h = Some y) \<longrightarrow> ptr |\<in>| shadow_root_ptr_kinds h
[PROOF STEP]
by (metis ObjectClass.get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_type_wf ObjectClass.type_wf_defs bind_eq_None_conv
      shadow_root_ptr_kinds_commutes get\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def option.simps(3))


[STATEMENT]
lemma "(\<exists>x. P x) \<longrightarrow> (\<exists>!x. P x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x. P x) \<longrightarrow> (\<exists>!x. P x)
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x. P x) \<longrightarrow> (\<exists>!x. P x)
[PROOF STEP]
oops