[STATEMENT]
lemma load_word_mem_8_low_equal:
assumes a1: "low_equal s1 s2"
shows "load_word_mem s1 address 8 = load_word_mem s2 address 8"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. load_word_mem s1 address 8 = load_word_mem s2 address 8
[PROOF STEP]
using a1
[PROOF STATE]
proof (prove)
using this:
low_equal s1 s2

goal (1 subgoal):
 1. load_word_mem s1 address 8 = load_word_mem s2 address 8
[PROOF STEP]
apply (simp add: low_equal_def load_word_mem_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cpu_reg s1 = cpu_reg s2 \<and> user_reg s1 = user_reg s2 \<and> sys_reg s1 = sys_reg s2 \<and> (\<forall>va. virt_to_phys va (mmu s1) (mem s1) = virt_to_phys va (mmu s2) (mem s2)) \<and> (\<forall>pa. user_accessible s1 pa \<longrightarrow> mem_equal s1 s2 pa) \<and> mmu s1 = mmu s2 \<and> state_var s1 = state_var s2 \<and> traps s1 = traps s2 \<and> undef s1 = undef s2 \<Longrightarrow> (case virt_to_phys address (mmu s2) (mem s1) of None \<Rightarrow> None | Some pair \<Rightarrow> if mmu_readable (get_acc_flag (snd pair)) 8 then mem_val_w32 8 (fst pair) s1 else None) = (case virt_to_phys address (mmu s2) (mem s2) of None \<Rightarrow> None | Some pair \<Rightarrow> if mmu_readable (get_acc_flag (snd pair)) 8 then mem_val_w32 8 (fst pair) s2 else None)
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. user_accessible s1 pa \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; undef s1 = undef s2\<rbrakk> \<Longrightarrow> (case virt_to_phys address (mmu s2) (mem s2) of None \<Rightarrow> None | Some pair \<Rightarrow> if mmu_readable (get_acc_flag (snd pair)) 8 then mem_val_w32 8 (fst pair) s1 else None) = (case virt_to_phys address (mmu s2) (mem s2) of None \<Rightarrow> None | Some pair \<Rightarrow> if mmu_readable (get_acc_flag (snd pair)) 8 then mem_val_w32 8 (fst pair) s2 else None)
[PROOF STEP]
apply (case_tac "virt_to_phys address (mmu s2) (mem s2) = None")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. user_accessible s1 pa \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; undef s1 = undef s2; virt_to_phys address (mmu s2) (mem s2) = None\<rbrakk> \<Longrightarrow> (case virt_to_phys address (mmu s2) (mem s2) of None \<Rightarrow> None | Some pair \<Rightarrow> if mmu_readable (get_acc_flag (snd pair)) 8 then mem_val_w32 8 (fst pair) s1 else None) = (case virt_to_phys address (mmu s2) (mem s2) of None \<Rightarrow> None | Some pair \<Rightarrow> if mmu_readable (get_acc_flag (snd pair)) 8 then mem_val_w32 8 (fst pair) s2 else None)
 2. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. user_accessible s1 pa \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; undef s1 = undef s2; virt_to_phys address (mmu s2) (mem s2) \<noteq> None\<rbrakk> \<Longrightarrow> (case virt_to_phys address (mmu s2) (mem s2) of None \<Rightarrow> None | Some pair \<Rightarrow> if mmu_readable (get_acc_flag (snd pair)) 8 then mem_val_w32 8 (fst pair) s1 else None) = (case virt_to_phys address (mmu s2) (mem s2) of None \<Rightarrow> None | Some pair \<Rightarrow> if mmu_readable (get_acc_flag (snd pair)) 8 then mem_val_w32 8 (fst pair) s2 else None)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. user_accessible s1 pa \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; virt_to_phys address (mmu s2) (mem s2) = Some (a, b); undef s1; undef s2; mmu_readable (get_acc_flag b) 8\<rbrakk> \<Longrightarrow> mem_val_w32 8 a s1 = mem_val_w32 8 a s2
 2. \<And>a b. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. user_accessible s1 pa \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; virt_to_phys address (mmu s2) (mem s2) = Some (a, b); \<not> undef s1; \<not> undef s2; mmu_readable (get_acc_flag b) 8\<rbrakk> \<Longrightarrow> mem_val_w32 8 a s1 = mem_val_w32 8 a s2
[PROOF STEP]
apply (simp add: user_accessible_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. (\<exists>va b. virt_to_phys va (mmu s2) (mem s2) = Some (pa, b) \<and> mmu_readable (get_acc_flag b) 10) \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; virt_to_phys address (mmu s2) (mem s2) = Some (a, b); undef s1; undef s2; mmu_readable (get_acc_flag b) 8\<rbrakk> \<Longrightarrow> mem_val_w32 8 a s1 = mem_val_w32 8 a s2
 2. \<And>a b. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. user_accessible s1 pa \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; virt_to_phys address (mmu s2) (mem s2) = Some (a, b); \<not> undef s1; \<not> undef s2; mmu_readable (get_acc_flag b) 8\<rbrakk> \<Longrightarrow> mem_val_w32 8 a s1 = mem_val_w32 8 a s2
[PROOF STEP]
using mem_val_w32_8_mem_equal user_accessible_8
[PROOF STATE]
proof (prove)
using this:
mem_equal ?s1.0 ?s2.0 ?a \<Longrightarrow> mem_val_w32 8 ?a ?s1.0 = mem_val_w32 8 ?a ?s2.0
mmu_readable (get_acc_flag (snd ?p)) 8 \<Longrightarrow> mmu_readable (get_acc_flag (snd ?p)) 10

goal (2 subgoals):
 1. \<And>a b. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. (\<exists>va b. virt_to_phys va (mmu s2) (mem s2) = Some (pa, b) \<and> mmu_readable (get_acc_flag b) 10) \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; virt_to_phys address (mmu s2) (mem s2) = Some (a, b); undef s1; undef s2; mmu_readable (get_acc_flag b) 8\<rbrakk> \<Longrightarrow> mem_val_w32 8 a s1 = mem_val_w32 8 a s2
 2. \<And>a b. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. user_accessible s1 pa \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; virt_to_phys address (mmu s2) (mem s2) = Some (a, b); \<not> undef s1; \<not> undef s2; mmu_readable (get_acc_flag b) 8\<rbrakk> \<Longrightarrow> mem_val_w32 8 a s1 = mem_val_w32 8 a s2
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. user_accessible s1 pa \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; virt_to_phys address (mmu s2) (mem s2) = Some (a, b); \<not> undef s1; \<not> undef s2; mmu_readable (get_acc_flag b) 8\<rbrakk> \<Longrightarrow> mem_val_w32 8 a s1 = mem_val_w32 8 a s2
[PROOF STEP]
apply (simp add: user_accessible_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. (\<exists>va b. virt_to_phys va (mmu s2) (mem s2) = Some (pa, b) \<and> mmu_readable (get_acc_flag b) 10) \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; virt_to_phys address (mmu s2) (mem s2) = Some (a, b); \<not> undef s1; \<not> undef s2; mmu_readable (get_acc_flag b) 8\<rbrakk> \<Longrightarrow> mem_val_w32 8 a s1 = mem_val_w32 8 a s2
[PROOF STEP]
using mem_val_w32_8_mem_equal user_accessible_8
[PROOF STATE]
proof (prove)
using this:
mem_equal ?s1.0 ?s2.0 ?a \<Longrightarrow> mem_val_w32 8 ?a ?s1.0 = mem_val_w32 8 ?a ?s2.0
mmu_readable (get_acc_flag (snd ?p)) 8 \<Longrightarrow> mmu_readable (get_acc_flag (snd ?p)) 10

goal (1 subgoal):
 1. \<And>a b. \<lbrakk>cpu_reg s1 = cpu_reg s2; user_reg s1 = user_reg s2; sys_reg s1 = sys_reg s2; \<forall>va. virt_to_phys va (mmu s2) (mem s1) = virt_to_phys va (mmu s2) (mem s2); \<forall>pa. (\<exists>va b. virt_to_phys va (mmu s2) (mem s2) = Some (pa, b) \<and> mmu_readable (get_acc_flag b) 10) \<longrightarrow> mem_equal s1 s2 pa; mmu s1 = mmu s2; state_var s1 = state_var s2; traps s1 = traps s2; virt_to_phys address (mmu s2) (mem s2) = Some (a, b); \<not> undef s1; \<not> undef s2; mmu_readable (get_acc_flag b) 8\<rbrakk> \<Longrightarrow> mem_val_w32 8 a s1 = mem_val_w32 8 a s2
[PROOF STEP]
by fastforce


[STATEMENT]
lemma Person_allInstances_generic_oclIsKindOf\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n:
"\<tau> \<Turnstile> ((OclAllInstances_generic pre_post Person)->forAll\<^sub>S\<^sub>e\<^sub>t(X|X .oclIsKindOf(Person)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<tau> \<Turnstile> UML_Set.OclForall (OclAllInstances_generic pre_post Person) OclIsKindOf\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n
[PROOF STEP]
apply(simp add: OclValid_def del: OclAllInstances_generic_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UML_Set.OclForall (OclAllInstances_generic pre_post OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA>) OclIsKindOf\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n \<tau> = true \<tau>
[PROOF STEP]
apply(simp only: UML_Set.OclForall_def refl if_True
                  OclAllInstances_generic_defined[simplified OclValid_def])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> \<tau>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = false \<tau> then false \<tau> else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> \<tau>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = invalid \<tau> then invalid \<tau> else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> \<tau>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = null \<tau> then null \<tau> else true \<tau>) = true \<tau>
[PROOF STEP]
apply(simp only: OclAllInstances_generic_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = false \<tau> then false \<tau> else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = invalid \<tau> then invalid \<tau> else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = null \<tau> then null \<tau> else true \<tau>) = true \<tau>
[PROOF STEP]
apply(subst (1 2 3) Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e_inverse, simp add: bot_option_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = false \<tau> then false \<tau> else if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = invalid \<tau> then invalid \<tau> else if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = null \<tau> then null \<tau> else true \<tau>) = true \<tau>
[PROOF STEP]
by(simp add: OclIsKindOf\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_Person)


[STATEMENT]
lemma auth_guard_step4:
  "s \<in> l2_inv5 \<Longrightarrow>
   s \<in> l2_inv1 \<Longrightarrow>
   Insec A B (hmac \<langle>Number 1, Exp Gen (NonceF (Rb$ny)), gnx, Agent A, Agent B\<rangle>
                        (Hash \<langle>Ni, NonceF (Rb$nr)\<rangle>))
     \<in> chan s \<Longrightarrow>
   guessed_runs Rb = \<lparr>role=Resp, owner=B, partner=A\<rparr> \<Longrightarrow>
   can_signal s A B \<Longrightarrow>
   (\<exists> Ra. guessed_runs Ra = \<lparr>role=Init, owner=A, partner=B\<rparr> \<and>
      in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \<and>
      guessed_frame Ra xgnx = Some gnx \<and>
      guessed_frame Ra xni = Some Ni \<and>
      guessed_frame Ra xnr = Some (NonceF (Rb$nr)) \<and>
      guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb$ny))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s \<in> l2_inv5; s \<in> l2_inv1; Insec A B (hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr)))) \<in> chan s; guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr>; can_signal s A B\<rbrakk> \<Longrightarrow> \<exists>Ra. guessed_runs Ra = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \<and> sklvl1.guessed_frame Ra xgnx = Some gnx \<and> sklvl1.guessed_frame Ra xni = Some Ni \<and> sklvl1.guessed_frame Ra xnr = Some (NonceF (Rb $ nr)) \<and> sklvl1.guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb $ ny)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>s \<in> l2_inv5; s \<in> l2_inv1; Insec A B (hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr)))) \<in> chan s; guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr>; can_signal s A B\<rbrakk> \<Longrightarrow> \<exists>Ra. guessed_runs Ra = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \<and> sklvl1.guessed_frame Ra xgnx = Some gnx \<and> sklvl1.guessed_frame Ra xni = Some Ni \<and> sklvl1.guessed_frame Ra xnr = Some (NonceF (Rb $ nr)) \<and> sklvl1.guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb $ ny)))
[PROOF STEP]
assume "s \<in> l2_inv1" "can_signal s A B"
[PROOF STATE]
proof (state)
this:
s \<in> l2_inv1
can_signal s A B

goal (1 subgoal):
 1. \<lbrakk>s \<in> l2_inv5; s \<in> l2_inv1; Insec A B (hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr)))) \<in> chan s; guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr>; can_signal s A B\<rbrakk> \<Longrightarrow> \<exists>Ra. guessed_runs Ra = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \<and> sklvl1.guessed_frame Ra xgnx = Some gnx \<and> sklvl1.guessed_frame Ra xni = Some Ni \<and> sklvl1.guessed_frame Ra xnr = Some (NonceF (Rb $ nr)) \<and> sklvl1.guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb $ ny)))
[PROOF STEP]
hence Hb:"A \<notin> bad s" "B \<notin> bad s"
[PROOF STATE]
proof (prove)
using this:
s \<in> l2_inv1
can_signal s A B

goal (1 subgoal):
 1. A \<notin> bad s &&& B \<notin> bad s
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
A \<notin> bad s
B \<notin> bad s

goal (1 subgoal):
 1. \<lbrakk>s \<in> l2_inv5; s \<in> l2_inv1; Insec A B (hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr)))) \<in> chan s; guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr>; can_signal s A B\<rbrakk> \<Longrightarrow> \<exists>Ra. guessed_runs Ra = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \<and> sklvl1.guessed_frame Ra xgnx = Some gnx \<and> sklvl1.guessed_frame Ra xni = Some Ni \<and> sklvl1.guessed_frame Ra xnr = Some (NonceF (Rb $ nr)) \<and> sklvl1.guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb $ ny)))
[PROOF STEP]
assume "Insec A B (hmac \<langle>Number 1, Exp Gen (NonceF (Rb$ny)), gnx, Agent A, Agent B\<rangle>
                        (Hash \<langle>Ni, NonceF (Rb$nr)\<rangle>)) \<in> chan s"
[PROOF STATE]
proof (state)
this:
Insec A B (hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr)))) \<in> chan s

goal (1 subgoal):
 1. \<lbrakk>s \<in> l2_inv5; s \<in> l2_inv1; Insec A B (hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr)))) \<in> chan s; guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr>; can_signal s A B\<rbrakk> \<Longrightarrow> \<exists>Ra. guessed_runs Ra = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \<and> sklvl1.guessed_frame Ra xgnx = Some gnx \<and> sklvl1.guessed_frame Ra xni = Some Ni \<and> sklvl1.guessed_frame Ra xnr = Some (NonceF (Rb $ nr)) \<and> sklvl1.guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb $ ny)))
[PROOF STEP]
hence HH:
    "hmac \<langle>Number 1, Exp Gen (NonceF (Rb$ny)), gnx, Agent A, Agent B\<rangle>
          (Hash \<langle>Ni, NonceF (Rb$nr)\<rangle>)
       \<in> parts (extr (bad s) (ik s) (chan s))"
[PROOF STATE]
proof (prove)
using this:
Insec A B (hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr)))) \<in> chan s

goal (1 subgoal):
 1. hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr))) \<in> parts (extr (bad s) (ik s) (chan s))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr))) \<in> parts (extr (bad s) (ik s) (chan s))

goal (1 subgoal):
 1. \<lbrakk>s \<in> l2_inv5; s \<in> l2_inv1; Insec A B (hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr)))) \<in> chan s; guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr>; can_signal s A B\<rbrakk> \<Longrightarrow> \<exists>Ra. guessed_runs Ra = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \<and> sklvl1.guessed_frame Ra xgnx = Some gnx \<and> sklvl1.guessed_frame Ra xni = Some Ni \<and> sklvl1.guessed_frame Ra xnr = Some (NonceF (Rb $ nr)) \<and> sklvl1.guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb $ ny)))
[PROOF STEP]
assume "s \<in> l2_inv5" "guessed_runs Rb = \<lparr>role=Resp, owner=B, partner=A\<rparr>"
[PROOF STATE]
proof (state)
this:
s \<in> l2_inv5
guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr>

goal (1 subgoal):
 1. \<lbrakk>s \<in> l2_inv5; s \<in> l2_inv1; Insec A B (hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr)))) \<in> chan s; guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr>; can_signal s A B\<rbrakk> \<Longrightarrow> \<exists>Ra. guessed_runs Ra = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \<and> sklvl1.guessed_frame Ra xgnx = Some gnx \<and> sklvl1.guessed_frame Ra xni = Some Ni \<and> sklvl1.guessed_frame Ra xnr = Some (NonceF (Rb $ nr)) \<and> sklvl1.guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb $ ny)))
[PROOF STEP]
with Hb HH
[PROOF STATE]
proof (chain)
picking this:
A \<notin> bad s
B \<notin> bad s
hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr))) \<in> parts (extr (bad s) (ik s) (chan s))
s \<in> l2_inv5
guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
A \<notin> bad s
B \<notin> bad s
hmac \<langle>Number 1, Exp Gen (NonceF (Rb $ ny)), gnx, Messages.Agent A, Messages.Agent B\<rangle> (hmac Ni (NonceF (Rb $ nr))) \<in> parts (extr (bad s) (ik s) (chan s))
s \<in> l2_inv5
guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr>

goal (1 subgoal):
 1. \<exists>Ra. guessed_runs Ra = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \<and> sklvl1.guessed_frame Ra xgnx = Some gnx \<and> sklvl1.guessed_frame Ra xni = Some Ni \<and> sklvl1.guessed_frame Ra xnr = Some (NonceF (Rb $ nr)) \<and> sklvl1.guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb $ ny)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>Ra. guessed_runs Ra = \<lparr>role = Init, owner = A, partner = B\<rparr> \<and> in_progressS (progress s Ra) {xnx, xni, xnr, xgnx, xgny, xsk, xEnd} \<and> sklvl1.guessed_frame Ra xgnx = Some gnx \<and> sklvl1.guessed_frame Ra xni = Some Ni \<and> sklvl1.guessed_frame Ra xnr = Some (NonceF (Rb $ nr)) \<and> sklvl1.guessed_frame Ra xgny = Some (Exp Gen (NonceF (Rb $ ny)))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "\<forall>x::('a,'b) T3. P x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x. P x
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x. P x
[PROOF STEP]
oops


[STATEMENT]
lemma integerize_tree_list_transfer[transfer_rule]:
  "rel_fun (list_all2 R) (=) integerize_tree_list integerize_tree_list"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_fun (list_all2 R) (=) integerize_tree_list integerize_tree_list
[PROOF STEP]
sorry


[STATEMENT]
theorem (in xvalid_program_progress) concurrent_direct_execution_simulates_store_buffer_execution:
assumes exec_sb: "(ts\<^sub>s\<^sub>b,m\<^sub>s\<^sub>b,x) \<Rightarrow>\<^sub>s\<^sub>b\<^sup>* (ts\<^sub>s\<^sub>b',m\<^sub>s\<^sub>b',x')"
assumes init: "initial\<^sub>s\<^sub>b ts\<^sub>s\<^sub>b \<S>\<^sub>s\<^sub>b"
assumes valid: "valid ts\<^sub>s\<^sub>b" (* FIXME: move into initial ?*)
assumes sim: "(ts\<^sub>s\<^sub>b,m\<^sub>s\<^sub>b,\<S>\<^sub>s\<^sub>b) \<sim> (ts,m,\<S>)"
assumes safe: "safe_reach_direct safe_free_flowing (ts,m,\<S>)"
shows "\<exists>ts\<^sub>h' \<S>\<^sub>h' ts' m' \<S>'.
          (ts\<^sub>s\<^sub>b,m\<^sub>s\<^sub>b,\<S>\<^sub>s\<^sub>b) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',m\<^sub>s\<^sub>b',\<S>\<^sub>h') \<and>
               ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h' \<and>
          (ts,m,\<S>) \<Rightarrow>\<^sub>d\<^sup>* (ts',m',\<S>') \<and>
                (ts\<^sub>h',m\<^sub>s\<^sub>b',\<S>\<^sub>h') \<sim> (ts',m',\<S>')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ts\<^sub>h' \<S>\<^sub>h' ts' m' \<S>'. (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<and> ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'  \<and> (ts, m, \<S>) \<Rightarrow>\<^sub>d\<^sup>* (ts', m', \<S>') \<and> (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>ts\<^sub>h' \<S>\<^sub>h' ts' m' \<S>'. (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<and> ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'  \<and> (ts, m, \<S>) \<Rightarrow>\<^sub>d\<^sup>* (ts', m', \<S>') \<and> (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')
[PROOF STEP]
from init
[PROOF STATE]
proof (chain)
picking this:
initial\<^sub>s\<^sub>b ts\<^sub>s\<^sub>b \<S>\<^sub>s\<^sub>b
[PROOF STEP]
interpret ini: initial\<^sub>s\<^sub>b ts\<^sub>s\<^sub>b \<S>\<^sub>s\<^sub>b
[PROOF STATE]
proof (prove)
using this:
initial\<^sub>s\<^sub>b ts\<^sub>s\<^sub>b \<S>\<^sub>s\<^sub>b

goal (1 subgoal):
 1. initial\<^sub>s\<^sub>b ts\<^sub>s\<^sub>b \<S>\<^sub>s\<^sub>b
[PROOF STEP]
.
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>ts\<^sub>h' \<S>\<^sub>h' ts' m' \<S>'. ini.sbh_concurrent_steps program_step (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<and> ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'  \<and> ini.direct_concurrent_steps program_step (ts, m, \<S>) (ts', m', \<S>') \<and> (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')
[PROOF STEP]
from concurrent_history_steps_simulates_store_buffer_steps [OF exec_sb ini.history_refl, of \<S>\<^sub>s\<^sub>b]
[PROOF STATE]
proof (chain)
picking this:
\<exists>ts\<^sub>h' \<S>\<^sub>h'. ini.sbh_concurrent_steps program_step (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<and> ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'
[PROOF STEP]
obtain ts\<^sub>h' \<S>\<^sub>h' where
    sbh: "(ts\<^sub>s\<^sub>b,m\<^sub>s\<^sub>b,\<S>\<^sub>s\<^sub>b) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',m\<^sub>s\<^sub>b',\<S>\<^sub>h')" and
    sim_sbh: "ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'"
[PROOF STATE]
proof (prove)
using this:
\<exists>ts\<^sub>h' \<S>\<^sub>h'. ini.sbh_concurrent_steps program_step (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<and> ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'

goal (1 subgoal):
 1. (\<And>ts\<^sub>h' \<S>\<^sub>h'. \<lbrakk>ini.sbh_concurrent_steps program_step (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h'); ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h' \<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ini.sbh_concurrent_steps program_step (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h')
ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'

goal (1 subgoal):
 1. \<exists>ts\<^sub>h' \<S>\<^sub>h' ts' m' \<S>'. ini.sbh_concurrent_steps program_step (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<and> ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'  \<and> ini.direct_concurrent_steps program_step (ts, m, \<S>) (ts', m', \<S>') \<and> (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')
[PROOF STEP]
from concurrent_direct_execution_simulates_store_buffer_history_execution [OF sbh init valid sim safe]
[PROOF STATE]
proof (chain)
picking this:
\<exists>ts' m' \<S>'. ini.direct_concurrent_steps program_step (ts, m, \<S>) (ts', m', \<S>') \<and> (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')
[PROOF STEP]
obtain ts' m' \<S>' where
    d: "(ts,m,\<S>) \<Rightarrow>\<^sub>d\<^sup>* (ts',m',\<S>')" and
    d_sim: "(ts\<^sub>h',m\<^sub>s\<^sub>b',\<S>\<^sub>h') \<sim> (ts',m',\<S>')"
[PROOF STATE]
proof (prove)
using this:
\<exists>ts' m' \<S>'. ini.direct_concurrent_steps program_step (ts, m, \<S>) (ts', m', \<S>') \<and> (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')

goal (1 subgoal):
 1. (\<And>ts' m' \<S>'. \<lbrakk>ini.direct_concurrent_steps program_step (ts, m, \<S>) (ts', m', \<S>'); (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ini.direct_concurrent_steps program_step (ts, m, \<S>) (ts', m', \<S>')
(ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')

goal (1 subgoal):
 1. \<exists>ts\<^sub>h' \<S>\<^sub>h' ts' m' \<S>'. ini.sbh_concurrent_steps program_step (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<and> ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'  \<and> ini.direct_concurrent_steps program_step (ts, m, \<S>) (ts', m', \<S>') \<and> (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')
[PROOF STEP]
with sbh sim_sbh
[PROOF STATE]
proof (chain)
picking this:
ini.sbh_concurrent_steps program_step (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h')
ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'
ini.direct_concurrent_steps program_step (ts, m, \<S>) (ts', m', \<S>')
(ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ini.sbh_concurrent_steps program_step (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h')
ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'
ini.direct_concurrent_steps program_step (ts, m, \<S>) (ts', m', \<S>')
(ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')

goal (1 subgoal):
 1. \<exists>ts\<^sub>h' \<S>\<^sub>h' ts' m' \<S>'. ini.sbh_concurrent_steps program_step (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<and> ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'  \<and> ini.direct_concurrent_steps program_step (ts, m, \<S>) (ts', m', \<S>') \<and> (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ts\<^sub>h' \<S>\<^sub>h' ts' m' \<S>'. ini.sbh_concurrent_steps program_step (ts\<^sub>s\<^sub>b, m\<^sub>s\<^sub>b, \<S>\<^sub>s\<^sub>b) (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<and> ts\<^sub>s\<^sub>b' \<sim>\<^sub>h ts\<^sub>h'  \<and> ini.direct_concurrent_steps program_step (ts, m, \<S>) (ts', m', \<S>') \<and> (ts\<^sub>h', m\<^sub>s\<^sub>b', \<S>\<^sub>h') \<sim> (ts', m', \<S>')

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma PO_m2_step6_refines_m1_step6:
  "{R12 \<inter> UNIV
        \<times> (m2_inv9a_init_M2a \<inter> m2_inv8_M4 \<inter> m2_inv5_ikk_sv \<inter> m2_inv4_M2a \<inter> m2_inv3b_leak)}
     (m1_step6 Ra A B Na Kab Ts Ta), (m2_step6 Ra A B Na Kab Ts Ta)
   {> R12}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {R12 \<inter> UNIV \<times> (m2_inv9a_init_M2a \<inter> m2_inv8_M4 \<inter> m2_inv5_ikk_sv \<inter> m2_inv4_M2a \<inter> m2_inv3b_leak)} m1_step6 Ra A B Na Kab Ts Ta, m2_step6 Ra A B Na Kab Ts Ta {> R12}
[PROOF STEP]
apply (auto simp add: PO_rhoare_defs R12_def m2_defs)
\<comment> \<open>1 subgoal\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a y. \<lbrakk>runs a = runs y; m1_state.leak a = m1_state.leak y; clk a = clk y; cache a = cache y; y \<in> m2_inv9a_init_M2a; y \<in> m2_inv8_M4; y \<in> m2_inv5_ikk_sv; y \<in> m2_inv4_M2a; y \<in> m2_inv3b_leak; runs y Ra = Some (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta]); Na = Ra $ na; clk y < Ts + Ls; dAuth Kab (Msg [aNum Ta]) \<in> chan y; A \<notin> bad; B \<notin> bad\<rbrakk> \<Longrightarrow> \<exists>Rb. runs y Rb = Some (Resp, [A, B], [aKey Kab, aNum Ts, aNum Ta])
[PROOF STEP]
apply (frule m2_inv9a_init_M2aD [THEN m2_inv4_M2aD], auto)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a y Rs. \<lbrakk>runs a = runs y; m1_state.leak a = m1_state.leak y; clk a = clk y; cache a = cache y; y \<in> m2_inv9a_init_M2a; y \<in> m2_inv8_M4; y \<in> m2_inv5_ikk_sv; y \<in> m2_inv4_M2a; y \<in> m2_inv3b_leak; runs y Ra = Some (Init, [A, B], [aKey (sesK (Rs $ sk)), aNum Ts, aNum Ta]); Na = Ra $ na; clk y < Ts + Ls; dAuth (sesK (Rs $ sk)) (Msg [aNum Ta]) \<in> chan y; A \<notin> bad; B \<notin> bad; runs y Rs = Some (Serv, [A, B], [aNon (Ra $ na), aNum Ts]); Kab = sesK (Rs $ sk)\<rbrakk> \<Longrightarrow> \<exists>Rb. runs y Rb = Some (Resp, [A, B], [aKey (sesK (Rs $ sk)), aNum Ts, aNum Ta])
[PROOF STEP]
apply (auto dest: m2_inv9a_init_M2aD [THEN m2_inv8_M4D] m2_inv5_ikk_svD [THEN m2_inv3b_leakD])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma new_character_data_get_tag_name_is_l_new_character_data_get_tag_name [instances]:
  "l_new_character_data_get_tag_name get_tag_name_locs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_new_character_data_get_tag_name get_tag_name_locs
[PROOF STEP]
unfolding l_new_character_data_get_tag_name_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>h new_character_data_ptr h' r ptr'. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> r \<in> get_tag_name_locs ptr' \<longrightarrow> r h h'
[PROOF STEP]
unfolding get_tag_name_locs_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>h new_character_data_ptr h' r ptr'. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> r \<in> {preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr' tag_name)} \<longrightarrow> r h h'
[PROOF STEP]
using new_character_data_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?h \<turnstile> new_character_data \<rightarrow>\<^sub>h ?h'; ?h \<turnstile> new_character_data \<rightarrow>\<^sub>r ?new_character_data_ptr\<rbrakk> \<Longrightarrow> preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ?ptr ?getter) ?h ?h'

goal (1 subgoal):
 1. \<forall>h new_character_data_ptr h' r ptr'. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> r \<in> {preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr' tag_name)} \<longrightarrow> r h h'
[PROOF STEP]
by blast


[STATEMENT]
lemma flush_step_sb_subset:
  assumes step: "(m,sb,\<O>) \<rightarrow>\<^sub>f (m', sb',\<O>')"
  shows "set sb' \<subseteq> set sb"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set sb' \<subseteq> set sb
[PROOF STEP]
using step
[PROOF STATE]
proof (prove)
using this:
(m, sb, \<O>) \<rightarrow>\<^sub>f (m', sb', \<O>')

goal (1 subgoal):
 1. set sb' \<subseteq> set sb
[PROOF STEP]
apply (induct c1=="(m,sb,\<O>)" c2=="(m',sb',\<O>')" arbitrary: m sb \<O> acq m' sb' \<O>' acq
  rule: flush_step.induct)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>\<O>' volatile \<O> A R \<S>' \<S> W L \<R>' \<R> m a sop v rs. \<lbrakk>\<O>' = (if volatile then \<O> \<union> A - R else \<O>); \<S>' = (if volatile then \<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L else \<S>); \<R>' = (if volatile then Map.empty else \<R>)\<rbrakk> \<Longrightarrow> set rs \<subseteq> set (Write\<^sub>s\<^sub>b volatile a sop v A L R W # rs)
 2. \<And>m volatile a t v rs \<O> \<R> \<S>. set rs \<subseteq> set (Read\<^sub>s\<^sub>b volatile a t v # rs)
 3. \<And>m p p' is rs \<O> \<R> \<S>. set rs \<subseteq> set (Prog\<^sub>s\<^sub>b p p' is # rs)
 4. \<And>m A L R W rs \<O> \<R> \<S>. set rs \<subseteq> set (Ghost\<^sub>s\<^sub>b A L R W # rs)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma bisim_sync_ok:
  "bisim Vs e e' xs \<Longrightarrow> sync_ok e"
  "bisim Vs e e' xs \<Longrightarrow> sync_ok e'"

  and bisims_sync_oks:
  "bisims Vs es es' xs \<Longrightarrow> sync_oks es"
  "bisims Vs es es' xs \<Longrightarrow> sync_oks es'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((bisim Vs e e' xs \<Longrightarrow> sync_ok e) &&& (bisim Vs e e' xs \<Longrightarrow> sync_ok e')) &&& (bisims Vs es es' xs \<Longrightarrow> sync_oks es) &&& (bisims Vs es es' xs \<Longrightarrow> sync_oks es')
[PROOF STEP]
apply(induct rule: bisim_bisims.inducts)
[PROOF STATE]
proof (prove)
goal (72 subgoals):
 1. \<And>Vs C xs. sync_ok (new C)
 2. \<And>Vs C xs. sync_ok (new C)
 3. \<And>Vs e e' xs T. \<lbrakk>bisim Vs e e' xs; sync_ok e; sync_ok e'\<rbrakk> \<Longrightarrow> sync_ok (newA T\<lfloor>e\<rceil>)
 4. \<And>Vs e e' xs T. \<lbrakk>bisim Vs e e' xs; sync_ok e; sync_ok e'\<rbrakk> \<Longrightarrow> sync_ok (newA T\<lfloor>e'\<rceil>)
 5. \<And>Vs e e' xs T. \<lbrakk>bisim Vs e e' xs; sync_ok e; sync_ok e'\<rbrakk> \<Longrightarrow> sync_ok (Cast T e)
 6. \<And>Vs e e' xs T. \<lbrakk>bisim Vs e e' xs; sync_ok e; sync_ok e'\<rbrakk> \<Longrightarrow> sync_ok (Cast T e')
 7. \<And>Vs e e' xs T. \<lbrakk>bisim Vs e e' xs; sync_ok e; sync_ok e'\<rbrakk> \<Longrightarrow> sync_ok (e instanceof T)
 8. \<And>Vs e e' xs T. \<lbrakk>bisim Vs e e' xs; sync_ok e; sync_ok e'\<rbrakk> \<Longrightarrow> sync_ok (e' instanceof T)
 9. \<And>Vs v xs. sync_ok (Val v)
 10. \<And>Vs v xs. sync_ok (Val v)
A total of 72 subgoals...
[PROOF STEP]
apply(auto intro: not_contains_insync_sync_ok not_contains_insyncs_sync_oks simp del: compEs1_conv_map)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "\<exists>!x. P x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>!x. P x
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>!x. P x
[PROOF STEP]
oops


[STATEMENT]
lemma heap_wellformed_induct_rev_si [consumes 1, case_names step]:
  assumes "heap_is_wellformed h"
  assumes "\<And>child. (\<And>parent child_node. child = cast child_node \<Longrightarrow>
h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent \<Longrightarrow> P parent)
      \<Longrightarrow> (\<And>host shadow_root. child = cast shadow_root \<Longrightarrow> h \<turnstile> get_host shadow_root \<rightarrow>\<^sub>r host \<Longrightarrow>
P (cast host))
      \<Longrightarrow> (\<And>disc_doc disc_node. child = cast disc_node \<Longrightarrow>
h \<turnstile> get_disconnected_document disc_node \<rightarrow>\<^sub>r disc_doc\<Longrightarrow> P (cast disc_doc))
      \<Longrightarrow> P child"
  shows "P ptr"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P ptr
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. P ptr
[PROOF STEP]
fix ptr
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. P ptr
[PROOF STEP]
have "finite (parent_child_rel h \<union> a_host_shadow_root_rel h \<union> a_ptr_disconnected_node_rel h)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)
[PROOF STEP]
using a_host_shadow_root_rel_finite a_ptr_disconnected_node_rel_finite
[PROOF STATE]
proof (prove)
using this:
finite (local.a_host_shadow_root_rel ?h)
finite (local.a_ptr_disconnected_node_rel ?h)

goal (1 subgoal):
 1. finite (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)
[PROOF STEP]
using local.CD.parent_child_rel_finite local.CD.parent_child_rel_impl
[PROOF STATE]
proof (prove)
using this:
finite (local.a_host_shadow_root_rel ?h)
finite (local.a_ptr_disconnected_node_rel ?h)
finite (parent_child_rel ?h)
parent_child_rel = local.CD.a_parent_child_rel

goal (1 subgoal):
 1. finite (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
finite (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)

goal (1 subgoal):
 1. P ptr
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)
[PROOF STEP]
have "wf (parent_child_rel h \<union> a_host_shadow_root_rel h \<union> a_ptr_disconnected_node_rel h)"
[PROOF STATE]
proof (prove)
using this:
finite (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)

goal (1 subgoal):
 1. wf (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)
[PROOF STEP]
using assms(1)
[PROOF STATE]
proof (prove)
using this:
finite (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)
heap_is_wellformed h

goal (1 subgoal):
 1. wf (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)
[PROOF STEP]
apply(simp add: heap_is_wellformed_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite (parent_child_rel h) \<and> finite (local.a_host_shadow_root_rel h) \<and> finite (local.a_ptr_disconnected_node_rel h); heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M h \<and> acyclic (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h) \<and> local.a_all_ptrs_in_heap h \<and> local.a_distinct_lists h \<and> local.a_shadow_root_valid h\<rbrakk> \<Longrightarrow> wf (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)
[PROOF STEP]
by (simp add: finite_acyclic_wf)
[PROOF STATE]
proof (state)
this:
wf (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)

goal (1 subgoal):
 1. P ptr
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
wf (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)
[PROOF STEP]
show "?thesis"
[PROOF STATE]
proof (prove)
using this:
wf (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h)

goal (1 subgoal):
 1. P ptr
[PROOF STEP]
proof (induct rule: wf_induct_rule)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. (\<And>y. (y, x) \<in> parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h \<Longrightarrow> P y) \<Longrightarrow> P x
[PROOF STEP]
case (less parent)
[PROOF STATE]
proof (state)
this:
(?y, parent) \<in> parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h \<Longrightarrow> P ?y

goal (1 subgoal):
 1. \<And>x. (\<And>y. (y, x) \<in> parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h \<Longrightarrow> P y) \<Longrightarrow> P x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(?y, parent) \<in> parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h \<Longrightarrow> P ?y
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(?y, parent) \<in> parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h \<Longrightarrow> P ?y

goal (1 subgoal):
 1. P parent
[PROOF STEP]
apply(auto)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>y. (y, parent) \<in> parent_child_rel h \<or> (y, parent) \<in> local.a_host_shadow_root_rel h \<or> (y, parent) \<in> local.a_ptr_disconnected_node_rel h \<Longrightarrow> P y) \<Longrightarrow> P parent
[PROOF STEP]
using parent_child_rel_parent a_host_shadow_root_rel_host a_ptr_disconnected_node_rel_document
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>heap_is_wellformed ?h; ?h \<turnstile> get_parent ?child_node \<rightarrow>\<^sub>r Some ?parent\<rbrakk> \<Longrightarrow> (?parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?child_node) \<in> parent_child_rel ?h
\<lbrakk>heap_is_wellformed ?h; ?h \<turnstile> get_host ?shadow_root \<rightarrow>\<^sub>r ?host\<rbrakk> \<Longrightarrow> (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?host, cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?shadow_root) \<in> local.a_host_shadow_root_rel ?h
\<lbrakk>heap_is_wellformed ?h; ?h \<turnstile> get_disconnected_document ?node_ptr \<rightarrow>\<^sub>r ?document\<rbrakk> \<Longrightarrow> (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?document, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?node_ptr) \<in> local.a_ptr_disconnected_node_rel ?h

goal (1 subgoal):
 1. (\<And>y. (y, parent) \<in> parent_child_rel h \<or> (y, parent) \<in> local.a_host_shadow_root_rel h \<or> (y, parent) \<in> local.a_ptr_disconnected_node_rel h \<Longrightarrow> P y) \<Longrightarrow> P parent
[PROOF STEP]
using assms(1) assms(2)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>heap_is_wellformed ?h; ?h \<turnstile> get_parent ?child_node \<rightarrow>\<^sub>r Some ?parent\<rbrakk> \<Longrightarrow> (?parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?child_node) \<in> parent_child_rel ?h
\<lbrakk>heap_is_wellformed ?h; ?h \<turnstile> get_host ?shadow_root \<rightarrow>\<^sub>r ?host\<rbrakk> \<Longrightarrow> (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?host, cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?shadow_root) \<in> local.a_host_shadow_root_rel ?h
\<lbrakk>heap_is_wellformed ?h; ?h \<turnstile> get_disconnected_document ?node_ptr \<rightarrow>\<^sub>r ?document\<rbrakk> \<Longrightarrow> (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?document, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?node_ptr) \<in> local.a_ptr_disconnected_node_rel ?h
heap_is_wellformed h
\<lbrakk>\<And>parent child_node. \<lbrakk>?child = cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node; h \<turnstile> get_parent child_node \<rightarrow>\<^sub>r Some parent\<rbrakk> \<Longrightarrow> P parent; \<And>host shadow_root. \<lbrakk>?child = cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r shadow_root; h \<turnstile> get_host shadow_root \<rightarrow>\<^sub>r host\<rbrakk> \<Longrightarrow> P (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r host); \<And>disc_doc disc_node. \<lbrakk>?child = cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_node; h \<turnstile> get_disconnected_document disc_node \<rightarrow>\<^sub>r disc_doc\<rbrakk> \<Longrightarrow> P (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r disc_doc)\<rbrakk> \<Longrightarrow> P ?child

goal (1 subgoal):
 1. (\<And>y. (y, parent) \<in> parent_child_rel h \<or> (y, parent) \<in> local.a_host_shadow_root_rel h \<or> (y, parent) \<in> local.a_ptr_disconnected_node_rel h \<Longrightarrow> P y) \<Longrightarrow> P parent
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
P parent

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
P ptr

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma PO_m3_inv7a_sesK_compr_step4:
  "{m3_inv7a_sesK_compr \<inter> m3_inv6_ticket \<inter> m3_inv4_lkeysec}
      m3_step4 Ra A B Na Kab Ts Ta X
   {> m3_inv7a_sesK_compr}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {m3_inv7a_sesK_compr \<inter> m3_inv6_ticket \<inter> m3_inv4_lkeysec} m3_step4 Ra A B Na Kab Ts Ta X {> m3_inv7a_sesK_compr}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {m3_inv7a_sesK_compr \<inter> m3_inv6_ticket \<inter> m3_inv4_lkeysec} m3_step4 Ra A B Na Kab Ts Ta X {> m3_inv7a_sesK_compr}
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {m3_inv7a_sesK_compr \<inter> m3_inv6_ticket \<inter> m3_inv4_lkeysec} m3_step4 Ra A B Na Kab Ts Ta X {> m3_inv7a_sesK_compr}
[PROOF STEP]
fix K KK s
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {m3_inv7a_sesK_compr \<inter> m3_inv6_ticket \<inter> m3_inv4_lkeysec} m3_step4 Ra A B Na Kab Ts Ta X {> m3_inv7a_sesK_compr}
[PROOF STEP]
assume H:
      "s \<in> m3_inv4_lkeysec" "s \<in> m3_inv7a_sesK_compr" "s \<in> m3_inv6_ticket"
      "runs s Ra = Some (Init, [A, B], [])"
      "Na = Ra$na"
      "KK \<subseteq> range sesK"
      "Crypt (shrK A) \<lbrace>Key Kab, Agent B, Number Ts, Nonce Na, X\<rbrace> \<in> analz (IK s)"
[PROOF STATE]
proof (state)
this:
s \<in> m3_inv4_lkeysec
s \<in> m3_inv7a_sesK_compr
s \<in> m3_inv6_ticket
runs s Ra = Some (Init, [A, B], [])
Na = Ra $ na
KK \<subseteq> range sesK
Crypt (shrK A) \<lbrace>Key Kab, msg.Agent B, Number Ts, Nonce Na, X\<rbrace> \<in> analz (IK s)

goal (1 subgoal):
 1. {m3_inv7a_sesK_compr \<inter> m3_inv6_ticket \<inter> m3_inv4_lkeysec} m3_step4 Ra A B Na Kab Ts Ta X {> m3_inv7a_sesK_compr}
[PROOF STEP]
have
      "(Key K \<in> analz (insert X (Key ` KK \<union> IK s))) =
          (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
proof (cases "A \<in> bad")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. A \<in> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
 2. A \<notin> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
A \<in> bad

goal (2 subgoals):
 1. A \<in> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
 2. A \<notin> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
with H
[PROOF STATE]
proof (chain)
picking this:
s \<in> m3_inv4_lkeysec
s \<in> m3_inv7a_sesK_compr
s \<in> m3_inv6_ticket
runs s Ra = Some (Init, [A, B], [])
Na = Ra $ na
KK \<subseteq> range sesK
Crypt (shrK A) \<lbrace>Key Kab, msg.Agent B, Number Ts, Nonce Na, X\<rbrace> \<in> analz (IK s)
A \<in> bad
[PROOF STEP]
have "X \<in> analz (IK s)"
[PROOF STATE]
proof (prove)
using this:
s \<in> m3_inv4_lkeysec
s \<in> m3_inv7a_sesK_compr
s \<in> m3_inv6_ticket
runs s Ra = Some (Init, [A, B], [])
Na = Ra $ na
KK \<subseteq> range sesK
Crypt (shrK A) \<lbrace>Key Kab, msg.Agent B, Number Ts, Nonce Na, X\<rbrace> \<in> analz (IK s)
A \<in> bad

goal (1 subgoal):
 1. X \<in> analz (IK s)
[PROOF STEP]
by (auto dest!: Decrypt)
[PROOF STATE]
proof (state)
this:
X \<in> analz (IK s)

goal (2 subgoals):
 1. A \<in> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
 2. A \<notin> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
X \<in> analz (IK s)

goal (2 subgoals):
 1. A \<in> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
 2. A \<notin> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
with H
[PROOF STATE]
proof (chain)
picking this:
s \<in> m3_inv4_lkeysec
s \<in> m3_inv7a_sesK_compr
s \<in> m3_inv6_ticket
runs s Ra = Some (Init, [A, B], [])
Na = Ra $ na
KK \<subseteq> range sesK
Crypt (shrK A) \<lbrace>Key Kab, msg.Agent B, Number Ts, Nonce Na, X\<rbrace> \<in> analz (IK s)
X \<in> analz (IK s)
[PROOF STEP]
have "X \<in> analz (Key ` KK \<union> IK s)"
[PROOF STATE]
proof (prove)
using this:
s \<in> m3_inv4_lkeysec
s \<in> m3_inv7a_sesK_compr
s \<in> m3_inv6_ticket
runs s Ra = Some (Init, [A, B], [])
Na = Ra $ na
KK \<subseteq> range sesK
Crypt (shrK A) \<lbrace>Key Kab, msg.Agent B, Number Ts, Nonce Na, X\<rbrace> \<in> analz (IK s)
X \<in> analz (IK s)

goal (1 subgoal):
 1. X \<in> analz (Key ` KK \<union> IK s)
[PROOF STEP]
by (auto intro: analz_monotonic)
[PROOF STATE]
proof (state)
this:
X \<in> analz (Key ` KK \<union> IK s)

goal (2 subgoals):
 1. A \<in> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
 2. A \<notin> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
X \<in> analz (IK s)
X \<in> analz (Key ` KK \<union> IK s)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
X \<in> analz (IK s)
X \<in> analz (Key ` KK \<union> IK s)

goal (1 subgoal):
 1. (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
using H
[PROOF STATE]
proof (prove)
using this:
X \<in> analz (IK s)
X \<in> analz (Key ` KK \<union> IK s)
s \<in> m3_inv4_lkeysec
s \<in> m3_inv7a_sesK_compr
s \<in> m3_inv6_ticket
runs s Ra = Some (Init, [A, B], [])
Na = Ra $ na
KK \<subseteq> range sesK
Crypt (shrK A) \<lbrace>Key Kab, msg.Agent B, Number Ts, Nonce Na, X\<rbrace> \<in> analz (IK s)

goal (1 subgoal):
 1. (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
by (auto simp add: m3_inv7a_sesK_compr_simps analz_insert_eq)
[PROOF STATE]
proof (state)
this:
(Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))

goal (1 subgoal):
 1. A \<notin> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. A \<notin> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
A \<notin> bad

goal (1 subgoal):
 1. A \<notin> bad \<Longrightarrow> (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
A \<notin> bad

goal (1 subgoal):
 1. (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
using H
[PROOF STATE]
proof (prove)
using this:
A \<notin> bad
s \<in> m3_inv4_lkeysec
s \<in> m3_inv7a_sesK_compr
s \<in> m3_inv6_ticket
runs s Ra = Some (Init, [A, B], [])
Na = Ra $ na
KK \<subseteq> range sesK
Crypt (shrK A) \<lbrace>Key Kab, msg.Agent B, Number Ts, Nonce Na, X\<rbrace> \<in> analz (IK s)

goal (1 subgoal):
 1. (Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))
[PROOF STEP]
by (fastforce simp add: m3_inv7a_sesK_compr_simps
                    dest!: m3_inv6_ticketD [OF analz_into_parts])
[PROOF STATE]
proof (state)
this:
(Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(Key K \<in> analz (insert X (Key ` KK \<union> IK s))) = (K \<in> KK \<or> Key K \<in> analz (insert X (IK s)))

goal (1 subgoal):
 1. {m3_inv7a_sesK_compr \<inter> m3_inv6_ticket \<inter> m3_inv4_lkeysec} m3_step4 Ra A B Na Kab Ts Ta X {> m3_inv7a_sesK_compr}
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>?s2 \<in> m3_inv4_lkeysec; ?s2 \<in> m3_inv7a_sesK_compr; ?s2 \<in> m3_inv6_ticket; runs ?s2 Ra = Some (Init, [A, B], []); Na = Ra $ na; ?KK2 \<subseteq> range sesK; Crypt (shrK A) \<lbrace>Key Kab, msg.Agent B, Number Ts, Nonce Na, X\<rbrace> \<in> analz (IK ?s2)\<rbrakk> \<Longrightarrow> (Key ?K2 \<in> analz (insert X (Key ` ?KK2 \<union> IK ?s2))) = (?K2 \<in> ?KK2 \<or> Key ?K2 \<in> analz (insert X (IK ?s2)))

goal (1 subgoal):
 1. {m3_inv7a_sesK_compr \<inter> m3_inv6_ticket \<inter> m3_inv4_lkeysec} m3_step4 Ra A B Na Kab Ts Ta X {> m3_inv7a_sesK_compr}
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?s2 \<in> m3_inv4_lkeysec; ?s2 \<in> m3_inv7a_sesK_compr; ?s2 \<in> m3_inv6_ticket; runs ?s2 Ra = Some (Init, [A, B], []); Na = Ra $ na; ?KK2 \<subseteq> range sesK; Crypt (shrK A) \<lbrace>Key Kab, msg.Agent B, Number Ts, Nonce Na, X\<rbrace> \<in> analz (IK ?s2)\<rbrakk> \<Longrightarrow> (Key ?K2 \<in> analz (insert X (Key ` ?KK2 \<union> IK ?s2))) = (?K2 \<in> ?KK2 \<or> Key ?K2 \<in> analz (insert X (IK ?s2)))

goal (1 subgoal):
 1. {m3_inv7a_sesK_compr \<inter> m3_inv6_ticket \<inter> m3_inv4_lkeysec} m3_step4 Ra A B Na Kab Ts Ta X {> m3_inv7a_sesK_compr}
[PROOF STEP]
by (auto simp add: PO_hoare_defs m3_defs intro!: m3_inv7a_sesK_comprI dest!: analz_Inj_IK)
[PROOF STATE]
proof (state)
this:
{m3_inv7a_sesK_compr \<inter> m3_inv6_ticket \<inter> m3_inv4_lkeysec} m3_step4 Ra A B Na Kab Ts Ta X {> m3_inv7a_sesK_compr}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma fp0_rel_ppath_cong[simp]:
  "(s,s')\<in>fp0_rel R \<Longrightarrow> fp0_state_impl.ppath s = fp0_state.ppath s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (s, s') \<in> fp0_rel R \<Longrightarrow> fp0_state_impl.ppath s = fp0_state.ppath s'
[PROOF STEP]
unfolding restr_simple_state_rel_def fp0_erel_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (s, s') \<in> {(s, s'). (ss_stack s, map (\<lambda>u. (u, pending s' `` {u})) (stack s')) \<in> \<langle>Id \<times>\<^sub>r {(U, U'). U - R = U'}\<rangle>list_rel \<and> on_stack s = set (stack s') \<and> visited s = dom (discovered s') \<union> R \<and> dom (discovered s') \<inter> R = {} \<and> dom (finished s') = dom (discovered s') - set (stack s') \<and> set (stack s') \<subseteq> dom (discovered s') \<and> (simple_state.more s, state.more s') \<in> {(\<lparr>fp0_state_impl.ppath = p\<rparr>, \<lparr>fp0_state.ppath = p\<rparr>) |p. True}} \<Longrightarrow> fp0_state_impl.ppath s = fp0_state.ppath s'
[PROOF STEP]
by (cases s, cases s', auto)


[STATEMENT]
lemma (in PolynRg) P_mod_diffxxx5_2:"\<lbrakk>Idomain S; t \<in> carrier S; t \<noteq> \<zero>\<^bsub>S\<^esub>;
  maximal_ideal S (S \<diamondsuit>\<^sub>p t); PolynRg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y; f \<in> carrier R;
  g \<in> carrier R; h \<in> carrier R;
  deg R S X g \<le> deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
               (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g);
  deg R S X h + deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R'
                      (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g) \<le> deg R S X f;
  0 < deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
      (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g);
  0 < deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
      (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) h);
  rel_prime_pols R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
    (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g)
    (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) h);
  P_mod R S X (S \<diamondsuit>\<^sub>p t) (f \<plusminus> -\<^sub>a (g \<cdot>\<^sub>r h))\<rbrakk> \<Longrightarrow>
                (Hpr\<^bsub>R S X t R' Y f g h\<^esub> m) \<in> carrier R \<times> carrier R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Idomain S; t \<in> carrier S; t \<noteq> \<zero>\<^bsub>S\<^esub>; maximal_ideal S (S \<diamondsuit>\<^sub>p t); PolynRg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y; f \<in> carrier R; g \<in> carrier R; h \<in> carrier R; deg R S X g \<le> deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g); deg R S X h + deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g) \<le> deg R S X f; 0 < deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g); 0 < deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) h); rel_prime_pols R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g) (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) h); P_mod R S X (S \<diamondsuit>\<^sub>p t) (f \<plusminus> -\<^sub>a g \<cdot>\<^sub>r h)\<rbrakk> \<Longrightarrow> Hpr\<^bsub> R S X t R' Y f g h\<^esub> m \<in> carrier R \<times> carrier R
[PROOF STEP]
apply (case_tac "m = 0", simp, simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Idomain S; t \<in> carrier S; t \<noteq> \<zero>\<^bsub>S\<^esub>; maximal_ideal S (S \<diamondsuit>\<^sub>p t); PolynRg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y; f \<in> carrier R; g \<in> carrier R; h \<in> carrier R; deg R S X g \<le> deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g); deg R S X h + deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g) \<le> deg R S X f; 0 < deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g); 0 < deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) h); rel_prime_pols R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g) (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) h); P_mod R S X (S \<diamondsuit>\<^sub>p t) (f \<plusminus> -\<^sub>a g \<cdot>\<^sub>r h); 0 < m\<rbrakk> \<Longrightarrow> Hpr\<^bsub> R S X t R' Y f g h\<^esub> m \<in> carrier R \<times> carrier R
[PROOF STEP]
apply (frule P_mod_diffxxx5_1[of t R' Y f g h
       "m - Suc 0"], assumption+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Idomain S; t \<in> carrier S; t \<noteq> \<zero>\<^bsub>S\<^esub>; maximal_ideal S (S \<diamondsuit>\<^sub>p t); PolynRg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y; f \<in> carrier R; g \<in> carrier R; h \<in> carrier R; deg R S X g \<le> deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g); deg R S X h + deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g) \<le> deg R S X f; 0 < deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g); 0 < deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) h); rel_prime_pols R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g) (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) h); P_mod R S X (S \<diamondsuit>\<^sub>p t) (f \<plusminus> -\<^sub>a g \<cdot>\<^sub>r h); 0 < m; Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0) \<in> carrier R \<times> carrier R \<and> erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))) = erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (fst (g, h)) \<and> erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (snd (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))) = erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (snd (g, h)) \<and> deg R S X (fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))) \<le> deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0)))) \<and> P_mod R S X (S \<diamondsuit>\<^sub>p (t^\<^bsup>S Suc (m - Suc 0)\<^esup>)) (fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> (m - Suc 0)) \<plusminus> -\<^sub>a fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))) \<and> deg R S X (snd (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))) + deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0)))) \<le> deg R S X f \<and> P_mod R S X (S \<diamondsuit>\<^sub>p (t^\<^bsup>S Suc (m - Suc 0)\<^esup>)) (snd (Hpr\<^bsub> R S X t R' Y f g h\<^esub> (m - Suc 0)) \<plusminus> -\<^sub>a snd (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))) \<and> P_mod R S X (S \<diamondsuit>\<^sub>p (t^\<^bsup>S Suc (Suc (m - Suc 0))\<^esup>)) (f \<plusminus> -\<^sub>a fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0)) \<cdot>\<^sub>r snd (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0)))\<rbrakk> \<Longrightarrow> Hpr\<^bsub> R S X t R' Y f g h\<^esub> m \<in> carrier R \<times> carrier R
[PROOF STEP]
apply (erule conjE)+
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Idomain S; t \<in> carrier S; t \<noteq> \<zero>\<^bsub>S\<^esub>; maximal_ideal S (S \<diamondsuit>\<^sub>p t); PolynRg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y; f \<in> carrier R; g \<in> carrier R; h \<in> carrier R; deg R S X g \<le> deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g); deg R S X h + deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g) \<le> deg R S X f; 0 < deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g); 0 < deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) h); rel_prime_pols R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) g) (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) h); P_mod R S X (S \<diamondsuit>\<^sub>p t) (f \<plusminus> -\<^sub>a g \<cdot>\<^sub>r h); 0 < m; Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0) \<in> carrier R \<times> carrier R; erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))) = erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (fst (g, h)); erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (snd (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))) = erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (snd (g, h)); deg R S X (fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))) \<le> deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0)))); P_mod R S X (S \<diamondsuit>\<^sub>p (t^\<^bsup>S Suc (m - Suc 0)\<^esup>)) (fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> (m - Suc 0)) \<plusminus> -\<^sub>a fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))); deg R S X (snd (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))) + deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y (pj S (S \<diamondsuit>\<^sub>p t)) (fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0)))) \<le> deg R S X f; P_mod R S X (S \<diamondsuit>\<^sub>p (t^\<^bsup>S Suc (m - Suc 0)\<^esup>)) (snd (Hpr\<^bsub> R S X t R' Y f g h\<^esub> (m - Suc 0)) \<plusminus> -\<^sub>a snd (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0))); P_mod R S X (S \<diamondsuit>\<^sub>p (t^\<^bsup>S Suc (Suc (m - Suc 0))\<^esup>)) (f \<plusminus> -\<^sub>a fst (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0)) \<cdot>\<^sub>r snd (Hpr\<^bsub> R S X t R' Y f g h\<^esub> Suc (m - Suc 0)))\<rbrakk> \<Longrightarrow> Hpr\<^bsub> R S X t R' Y f g h\<^esub> m \<in> carrier R \<times> carrier R
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma dests_bigger_than_sqn:
  "paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l). l \<in> {PAodv-:15..PAodv-:19}
                                 \<union> {PPkt-:7..PPkt-:11}
                                 \<union> {PRreq-:9..PRreq-:13}
                                 \<union> {PRreq-:21..PRreq-:25}
                                 \<union> {PRrep-:9..PRrep-:13}
                                 \<union> {PRerr-:1..PRerr-:5}
                         \<longrightarrow> (\<forall>ip\<in>dom(dests \<xi>). ip\<in>kD(rt \<xi>) \<and> sqn (rt \<xi>) ip \<le> the (dests \<xi> ip)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l). l \<in> {PAodv-:15..PAodv-:19} \<union> {PPkt-:7..PPkt-:11} \<union> {PRreq-:9..PRreq-:13} \<union> {PRreq-:21..PRreq-:25} \<union> {PRrep-:9..PRrep-:13} \<union> {PRerr-:1..PRerr-:5} \<longrightarrow> (\<forall>ip\<in>dom (dests \<xi>). ip \<in> kD (rt \<xi>) \<and> sqn (rt \<xi>) ip \<le> the (dests \<xi> ip)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l). l \<in> {PAodv-:15..PAodv-:19} \<union> {PPkt-:7..PPkt-:11} \<union> {PRreq-:9..PRreq-:13} \<union> {PRreq-:21..PRreq-:25} \<union> {PRrep-:9..PRrep-:13} \<union> {PRerr-:1..PRerr-:5} \<longrightarrow> (\<forall>ip\<in>dom (dests \<xi>). ip \<in> kD (rt \<xi>) \<and> sqn (rt \<xi>) ip \<le> the (dests \<xi> ip)))
[PROOF STEP]
have sqninv:
      "\<And>dests rt rsn ip.
       \<lbrakk> \<forall>ip\<in>dom(dests). ip\<in>kD(rt) \<and> sqn rt ip \<le> the (dests ip); dests ip = Some rsn \<rbrakk>
        \<Longrightarrow> sqn (invalidate rt dests) ip \<le> rsn"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>dests rt rsn ip. \<lbrakk>\<forall>ip\<in>dom dests. ip \<in> kD rt \<and> sqn rt ip \<le> the (dests ip); dests ip = Some rsn\<rbrakk> \<Longrightarrow> sqn (invalidate rt dests) ip \<le> rsn
[PROOF STEP]
by (rule sqn_invalidate_in_dests [THEN eq_imp_le], assumption) auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>ip\<in>dom ?dests. ip \<in> kD ?rt \<and> sqn ?rt ip \<le> the (?dests ip); ?dests ?ip = Some ?rsn\<rbrakk> \<Longrightarrow> sqn (invalidate ?rt ?dests) ?ip \<le> ?rsn

goal (1 subgoal):
 1. paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l). l \<in> {PAodv-:15..PAodv-:19} \<union> {PPkt-:7..PPkt-:11} \<union> {PRreq-:9..PRreq-:13} \<union> {PRreq-:21..PRreq-:25} \<union> {PRrep-:9..PRrep-:13} \<union> {PRerr-:1..PRerr-:5} \<longrightarrow> (\<forall>ip\<in>dom (dests \<xi>). ip \<in> kD (rt \<xi>) \<and> sqn (rt \<xi>) ip \<le> the (dests \<xi> ip)))
[PROOF STEP]
have indests:
      "\<And>dests rt rsn ip.
       \<lbrakk> \<forall>ip\<in>dom(dests). ip\<in>kD(rt) \<and> sqn rt ip \<le> the (dests ip); dests ip = Some rsn \<rbrakk>
        \<Longrightarrow> ip\<in>kD(rt) \<and> sqn rt ip \<le> rsn"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>dests rt rsn ip. \<lbrakk>\<forall>ip\<in>dom dests. ip \<in> kD rt \<and> sqn rt ip \<le> the (dests ip); dests ip = Some rsn\<rbrakk> \<Longrightarrow> ip \<in> kD rt \<and> sqn rt ip \<le> rsn
[PROOF STEP]
by (metis domI option.sel)
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>ip\<in>dom ?dests. ip \<in> kD ?rt \<and> sqn ?rt ip \<le> the (?dests ip); ?dests ?ip = Some ?rsn\<rbrakk> \<Longrightarrow> ?ip \<in> kD ?rt \<and> sqn ?rt ?ip \<le> ?rsn

goal (1 subgoal):
 1. paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l). l \<in> {PAodv-:15..PAodv-:19} \<union> {PPkt-:7..PPkt-:11} \<union> {PRreq-:9..PRreq-:13} \<union> {PRreq-:21..PRreq-:25} \<union> {PRrep-:9..PRrep-:13} \<union> {PRerr-:1..PRerr-:5} \<longrightarrow> (\<forall>ip\<in>dom (dests \<xi>). ip \<in> kD (rt \<xi>) \<and> sqn (rt \<xi>) ip \<le> the (dests \<xi> ip)))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l). l \<in> {PAodv-:15..PAodv-:19} \<union> {PPkt-:7..PPkt-:11} \<union> {PRreq-:9..PRreq-:13} \<union> {PRreq-:21..PRreq-:25} \<union> {PRrep-:9..PRrep-:13} \<union> {PRerr-:1..PRerr-:5} \<longrightarrow> (\<forall>ip\<in>dom (dests \<xi>). ip \<in> kD (rt \<xi>) \<and> sqn (rt \<xi>) ip \<le> the (dests \<xi> ip)))
[PROOF STEP]
by inv_cterms
         (clarsimp split: if_split_asm option.split_asm
                   elim!: sqninv indests)+
[PROOF STATE]
proof (state)
this:
paodv i \<TTurnstile> onl \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>(\<xi>, l). l \<in> {PAodv-:15..PAodv-:19} \<union> {PPkt-:7..PPkt-:11} \<union> {PRreq-:9..PRreq-:13} \<union> {PRreq-:21..PRreq-:25} \<union> {PRrep-:9..PRrep-:13} \<union> {PRerr-:1..PRerr-:5} \<longrightarrow> (\<forall>ip\<in>dom (dests \<xi>). ip \<in> kD (rt \<xi>) \<and> sqn (rt \<xi>) ip \<le> the (dests \<xi> ip)))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "(f::'a\<Rightarrow>'b) = g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f = g
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f = g
[PROOF STEP]
oops


[STATEMENT]
lemma rel_U_witness1:
  fixes L1 :: "'l1 \<Rightarrow> 'l1'' \<Rightarrow> bool"
    and Co1 :: "'co1 \<Rightarrow> 'co1' \<Rightarrow> bool" and Co1' :: "'co1' \<Rightarrow> 'co1'' \<Rightarrow> bool"
    and Co2 :: "'co2 \<Rightarrow> 'co2' \<Rightarrow> bool" and Co2' :: "'co2' \<Rightarrow> 'co2'' \<Rightarrow> bool"
    and Contra1 :: "'contra1 \<Rightarrow> 'contra1' \<Rightarrow> bool" and Contra1' :: "'contra1' \<Rightarrow> 'contra1'' \<Rightarrow> bool"
    and Contra2 :: "'contra2 \<Rightarrow> 'contra2' \<Rightarrow> bool" and Contra2' :: "'contra2' \<Rightarrow> 'contra2'' \<Rightarrow> bool"
    and tytok_G :: "(('l1, 'co1, 'co2, 'contra1, 'contra2, 'f) U \<times>
             (('l1, 'co1, 'co2, 'contra1, 'contra2, 'f) U \<times>
              ('l1'', 'co1'', 'co2'', 'contra1'', 'contra2'', 'f) U) \<times>
             ('l1'', 'co1'', 'co2'', 'contra1'', 'contra2'', 'f) U \<times>
             'l1 \<times> ('l1 \<times> 'l1'') \<times> 'l1'' \<times> 'f) itself"
    and x :: "(_, _, _, _, _, 'f) U"
  assumes cond: "rel_G_neg_distr_cond Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' tytok_G"
    and rel_OO: "rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') x y"
  shows "rel_U (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 x
      (rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (x, y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_U (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 x (rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (x, y))
[PROOF STEP]
using rel_OO
[PROOF STATE]
proof (prove)
using this:
rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') x y

goal (1 subgoal):
 1. rel_U (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 x (rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (x, y))
[PROOF STEP]
apply (coinduction arbitrary: x y)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x y. rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') x y \<Longrightarrow> \<exists>xa ya. x = xa \<and> rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (x, y) = ya \<and> rel_G (\<lambda>uu_ uua_. (\<exists>x y. uu_ = x \<and> uua_ = rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (x, y) \<and> rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') x y) \<or> rel_U (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 uu_ uua_) (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 (D_U xa) (D_U ya)
[PROOF STEP]
apply (erule rel_U.cases)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x y xa ya. \<lbrakk>x = xa; y = ya; rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya)\<rbrakk> \<Longrightarrow> \<exists>xa ya. x = xa \<and> rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (x, y) = ya \<and> rel_G (\<lambda>uu_ uua_. (\<exists>x y. uu_ = x \<and> uua_ = rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (x, y) \<and> rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') x y) \<or> rel_U (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 uu_ uua_) (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 (D_U xa) (D_U ya)
[PROOF STEP]
apply (clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa ya. rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya) \<Longrightarrow> rel_G (\<lambda>uu_ uua_. (\<exists>y. uua_ = rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (uu_, y) \<and> rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') uu_ y) \<or> rel_U (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 uu_ uua_) (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 (D_U xa) (mapl_G (rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2') id (rel_G_witness (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (D_U xa, D_U ya)))
[PROOF STEP]
apply (rewrite in "rel_G _ _ _ _ _ _ \<hole> _" map_G_id[symmetric])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa ya. rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya) \<Longrightarrow> rel_G (\<lambda>uu_ uua_. (\<exists>y. uua_ = rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (uu_, y) \<and> rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') uu_ y) \<or> rel_U (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 uu_ uua_) (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 (map_G id id id id id id (D_U xa)) (mapl_G (rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2') id (rel_G_witness (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (D_U xa, D_U ya)))
[PROOF STEP]
apply (subst mapl_G_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa ya. rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya) \<Longrightarrow> rel_G (\<lambda>uu_ uua_. (\<exists>y. uua_ = rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (uu_, y) \<and> rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') uu_ y) \<or> rel_U (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 uu_ uua_) (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 (map_G id id id id id id (D_U xa)) (map_G (rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2') id id id id id (rel_G_witness (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (D_U xa, D_U ya)))
[PROOF STEP]
apply (rule map_G_rel_cong)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>xa ya. rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya) \<Longrightarrow> rel_G (?L1.18 xa ya) (?L2.18 xa ya) (?Co1.18 xa ya) (?Co2.18 xa ya) (?Contra1.18 xa ya) (?Contra2.18 xa ya) (D_U xa) (rel_G_witness (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (D_U xa, D_U ya))
 2. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); ?L1.18 xa ya x y\<rbrakk> \<Longrightarrow> (\<exists>ya. rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' y = rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (id x, ya) \<and> rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (id x) ya) \<or> rel_U (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 (id x) (rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' y)
 3. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); ?L2.18 xa ya x y\<rbrakk> \<Longrightarrow> case id y of (x', y) \<Rightarrow> x' = id x \<and> L1 (id x) y
 4. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); ?Co1.18 xa ya x y\<rbrakk> \<Longrightarrow> Co1 (id x) (id y)
 5. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); ?Co2.18 xa ya x y\<rbrakk> \<Longrightarrow> Co2 (id x) (id y)
 6. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); Contra1 x y\<rbrakk> \<Longrightarrow> ?Contra1.18 xa ya (id x) (id y)
 7. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); Contra2 x y\<rbrakk> \<Longrightarrow> ?Contra2.18 xa ya (id x) (id y)
[PROOF STEP]
apply (erule rel_G_witness1[OF cond])
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); case y of (x', y) \<Rightarrow> x' = x \<and> rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') x y\<rbrakk> \<Longrightarrow> (\<exists>ya. rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' y = rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' (id x, ya) \<and> rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (id x) ya) \<or> rel_U (\<lambda>x (x', y). x' = x \<and> L1 x y) Co1 Co2 Contra1 Contra2 (id x) (rel_U_witness L1 Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' y)
 2. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); case y of (x', y) \<Rightarrow> x' = x \<and> L1 x y\<rbrakk> \<Longrightarrow> case id y of (x', y) \<Rightarrow> x' = id x \<and> L1 (id x) y
 3. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); Co1 x y\<rbrakk> \<Longrightarrow> Co1 (id x) (id y)
 4. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); Co2 x y\<rbrakk> \<Longrightarrow> Co2 (id x) (id y)
 5. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); Contra1 x y\<rbrakk> \<Longrightarrow> Contra1 (id x) (id y)
 6. \<And>xa ya x y. \<lbrakk>rel_G (rel_U L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2')) L1 (Co1 OO Co1') (Co2 OO Co2') (Contra1 OO Contra1') (Contra2 OO Contra2') (D_U xa) (D_U ya); Contra2 x y\<rbrakk> \<Longrightarrow> Contra2 (id x) (id y)
[PROOF STEP]
apply (auto)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done