[STATEMENT]
lemma PO_m1_inv2i_serv [iff]: "reach m1 \<subseteq> m1_inv2i_serv"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reach m1 \<subseteq> m1_inv2i_serv
[PROOF STEP]
apply (rule_tac Pa=m1a_inv2i_serv and Qa=m1a_inv2i_serv and Q=m1_inv2i_serv
       in internal_invariant_translation)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. reach ?Sa \<subseteq> m1a_inv2i_serv
 2. m1a_inv2i_serv \<subseteq> obs ?Sa -` m1a_inv2i_serv
 3. ?pi -` m1a_inv2i_serv \<subseteq> m1_inv2i_serv
 4. obs m1 -` m1_inv2i_serv \<subseteq> m1_inv2i_serv
 5. implements ?pi ?Sa m1
[PROOF STEP]
apply (auto del: subsetI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. med1a1 -` m1a_inv2i_serv \<subseteq> m1_inv2i_serv
[PROOF STEP]
apply (auto simp add: m1a_inv2i_serv_def med1a1_def vimage_def
            intro!: m1_inv2i_servI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x A B Ra Kab nla. \<lbrakk>A \<notin> bad; runs x Ra = Some (Init, [A, B], aKey Kab # nla); \<forall>A. A \<notin> bad \<longrightarrow> (\<forall>B Ra Kab. (\<exists>nla. runs1a1 (runs x) Ra = Some (Init, [A, B], aKey Kab # nla)) \<longrightarrow> (\<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs1a1 (runs x) Rs = Some (Serv, [A, B], [aNon (Ra $ na)])))\<rbrakk> \<Longrightarrow> \<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs x Rs = Some (Serv, [A, B], [aNon (Ra $ na)])
[PROOF STEP]
apply (rename_tac s A B Ra Kab nla)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s A B Ra Kab nla. \<lbrakk>A \<notin> bad; runs s Ra = Some (Init, [A, B], aKey Kab # nla); \<forall>A. A \<notin> bad \<longrightarrow> (\<forall>B Ra Kab. (\<exists>nla. runs1a1 (runs s) Ra = Some (Init, [A, B], aKey Kab # nla)) \<longrightarrow> (\<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs1a1 (runs s) Rs = Some (Serv, [A, B], [aNon (Ra $ na)])))\<rbrakk> \<Longrightarrow> \<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs s Rs = Some (Serv, [A, B], [aNon (Ra $ na)])
[PROOF STEP]
apply (drule_tac x=A in spec, clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s A B Ra Kab nla. \<lbrakk>A \<notin> bad; runs s Ra = Some (Init, [A, B], aKey Kab # nla); \<forall>B Ra Kab. (\<exists>nla. runs1a1 (runs s) Ra = Some (Init, [A, B], aKey Kab # nla)) \<longrightarrow> (\<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs1a1 (runs s) Rs = Some (Serv, [A, B], [aNon (Ra $ na)]))\<rbrakk> \<Longrightarrow> \<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs s Rs = Some (Serv, [A, B], [aNon (Ra $ na)])
[PROOF STEP]
apply (drule_tac x=B in spec)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s A B Ra Kab nla. \<lbrakk>A \<notin> bad; runs s Ra = Some (Init, [A, B], aKey Kab # nla); \<forall>Ra Kab. (\<exists>nla. runs1a1 (runs s) Ra = Some (Init, [A, B], aKey Kab # nla)) \<longrightarrow> (\<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs1a1 (runs s) Rs = Some (Serv, [A, B], [aNon (Ra $ na)]))\<rbrakk> \<Longrightarrow> \<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs s Rs = Some (Serv, [A, B], [aNon (Ra $ na)])
[PROOF STEP]
apply (drule_tac x=Ra in spec)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s A B Ra Kab nla. \<lbrakk>A \<notin> bad; runs s Ra = Some (Init, [A, B], aKey Kab # nla); \<forall>Kab. (\<exists>nla. runs1a1 (runs s) Ra = Some (Init, [A, B], aKey Kab # nla)) \<longrightarrow> (\<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs1a1 (runs s) Rs = Some (Serv, [A, B], [aNon (Ra $ na)]))\<rbrakk> \<Longrightarrow> \<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs s Rs = Some (Serv, [A, B], [aNon (Ra $ na)])
[PROOF STEP]
apply (drule_tac x=Kab in spec)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s A B Ra Kab nla. \<lbrakk>A \<notin> bad; runs s Ra = Some (Init, [A, B], aKey Kab # nla); (\<exists>nla. runs1a1 (runs s) Ra = Some (Init, [A, B], aKey Kab # nla)) \<longrightarrow> (\<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs1a1 (runs s) Rs = Some (Serv, [A, B], [aNon (Ra $ na)]))\<rbrakk> \<Longrightarrow> \<exists>Rs. Kab = sesK (Rs $ sk) \<and> runs s Rs = Some (Serv, [A, B], [aNon (Ra $ na)])
[PROOF STEP]
apply (clarsimp simp add: runs1a1_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done