[STATEMENT]
lemma serial_strips_equivalent_to_serial_sas_plus_i:
  assumes "ops \<in> set (\<phi>\<^sub>P\<inverse> \<Pi> (embed \<pi>))"
  obtains op where "op \<in> set \<pi>" and "ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
let ?\<pi>' = "embed \<pi>"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
have "set (\<phi>\<^sub>P\<inverse> \<Pi> (embed \<pi>)) = { [\<phi>\<^sub>O\<inverse> \<Pi> op. op \<leftarrow> ops]  | ops. ops \<in> set ?\<pi>' }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (\<phi>\<^sub>P\<inverse> \<Pi> List_Supplement.embed \<pi>) = {map (strips_op_to_sasp \<Pi>) ops |ops. ops \<in> set (List_Supplement.embed \<pi>)}
[PROOF STEP]
unfolding strips_parallel_plan_to_sas_plus_parallel_plan_def
        SAS_Plus_STRIPS.strips_parallel_plan_to_sas_plus_parallel_plan_def
        strips_op_to_sasp_def set_map
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map (\<lambda>op. let precondition = strips_operator.precondition_of op; effect = add_effects_of op in \<lparr>sas_plus_operator.precondition_of = precondition, effect_of = effect\<rparr>) ` set (List_Supplement.embed \<pi>) = {map (\<lambda>op. let precondition = strips_operator.precondition_of op; effect = add_effects_of op in \<lparr>sas_plus_operator.precondition_of = precondition, effect_of = effect\<rparr>) ops |ops. ops \<in> set (List_Supplement.embed \<pi>)}
[PROOF STEP]
using setcompr_eq_image
[PROOF STATE]
proof (prove)
using this:
{?f x |x. ?P x} = ?f ` {x. ?P x}

goal (1 subgoal):
 1. map (\<lambda>op. let precondition = strips_operator.precondition_of op; effect = add_effects_of op in \<lparr>sas_plus_operator.precondition_of = precondition, effect_of = effect\<rparr>) ` set (List_Supplement.embed \<pi>) = {map (\<lambda>op. let precondition = strips_operator.precondition_of op; effect = add_effects_of op in \<lparr>sas_plus_operator.precondition_of = precondition, effect_of = effect\<rparr>) ops |ops. ops \<in> set (List_Supplement.embed \<pi>)}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
set (\<phi>\<^sub>P\<inverse> \<Pi> List_Supplement.embed \<pi>) = {map (strips_op_to_sasp \<Pi>) ops |ops. ops \<in> set (List_Supplement.embed \<pi>)}

goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
set (\<phi>\<^sub>P\<inverse> \<Pi> List_Supplement.embed \<pi>) = {map (strips_op_to_sasp \<Pi>) ops |ops. ops \<in> set (List_Supplement.embed \<pi>)}

goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
obtain ops' where "ops' \<in> set ?\<pi>'" and "ops = [\<phi>\<^sub>O\<inverse> \<Pi> op. op \<leftarrow> ops']"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ops'. \<lbrakk>ops' \<in> set (List_Supplement.embed \<pi>); ops = map (strips_op_to_sasp \<Pi>) ops'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms(1) calculation
[PROOF STATE]
proof (prove)
using this:
ops \<in> set (\<phi>\<^sub>P\<inverse> \<Pi> List_Supplement.embed \<pi>)
set (\<phi>\<^sub>P\<inverse> \<Pi> List_Supplement.embed \<pi>) = {map (strips_op_to_sasp \<Pi>) ops |ops. ops \<in> set (List_Supplement.embed \<pi>)}

goal (1 subgoal):
 1. (\<And>ops'. \<lbrakk>ops' \<in> set (List_Supplement.embed \<pi>); ops = map (strips_op_to_sasp \<Pi>) ops'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ops' \<in> set (List_Supplement.embed \<pi>)
ops = map (strips_op_to_sasp \<Pi>) ops'

goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ops' \<in> set (List_Supplement.embed \<pi>)
ops = map (strips_op_to_sasp \<Pi>) ops'

goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
obtain op where "op \<in> set \<pi>" and "ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using embedded_serial_strips_plan_operator_structure calculation(2, 3)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?ops' \<in> set (List_Supplement.embed ?\<pi>); \<And>op. \<lbrakk>op \<in> set ?\<pi>; map (strips_op_to_sasp ?\<Pi>) ?ops' = [\<phi>\<^sub>O\<inverse> ?\<Pi> op]\<rbrakk> \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
ops' \<in> set (List_Supplement.embed \<pi>)
ops = map (strips_op_to_sasp \<Pi>) ops'

goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
op \<in> set \<pi>
ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]

goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
set (\<phi>\<^sub>P\<inverse> \<Pi> List_Supplement.embed \<pi>) = {map (strips_op_to_sasp \<Pi>) ops |ops. ops \<in> set (List_Supplement.embed \<pi>)}
ops' \<in> set (List_Supplement.embed \<pi>)
ops = map (strips_op_to_sasp \<Pi>) ops'
op \<in> set \<pi>
ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]
[PROOF STEP]
have "\<exists>op \<in> set \<pi>. ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]"
[PROOF STATE]
proof (prove)
using this:
set (\<phi>\<^sub>P\<inverse> \<Pi> List_Supplement.embed \<pi>) = {map (strips_op_to_sasp \<Pi>) ops |ops. ops \<in> set (List_Supplement.embed \<pi>)}
ops' \<in> set (List_Supplement.embed \<pi>)
ops = map (strips_op_to_sasp \<Pi>) ops'
op \<in> set \<pi>
ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]

goal (1 subgoal):
 1. \<exists>op\<in>set \<pi>. ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
\<exists>op\<in>set \<pi>. ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]

goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<exists>op\<in>set \<pi>. ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]

goal (1 subgoal):
 1. (\<And>op. \<lbrakk>op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<exists>op\<in>set \<pi>. ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
\<exists>op\<in>set \<pi>. ops = [\<phi>\<^sub>O\<inverse> \<Pi> op]
\<lbrakk>?op \<in> set \<pi>; ops = [\<phi>\<^sub>O\<inverse> \<Pi> ?op]\<rbrakk> \<Longrightarrow> thesis

goal (1 subgoal):
 1. thesis
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
thesis

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma dynlookup_access:
  assumes emh: "emh \<in> mheads G accC statT sig" and
    dynC_prop: "G,statT \<turnstile> dynC valid_lookup_cls_for (is_static emh) " and
    isT_statT: "isrtype G statT" and
           wf: "wf_prog G"
  shows "\<exists> dynM. dynlookup G statT dynC sig = Some dynM \<and>
            G\<turnstile>Methd sig dynM in dynC dyn_accessible_from accC"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>dynM. dynlookup G statT dynC sig = Some dynM \<and> G \<turnstile>Methd sig dynM in dynC dyn_accessible_from accC
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>dynM. dynlookup G statT dynC sig = Some dynM \<and> G \<turnstile>Methd sig dynM in dynC dyn_accessible_from accC
[PROOF STEP]
from dynC_prop isT_statT wf
[PROOF STATE]
proof (chain)
picking this:
G,statT \<turnstile> dynC valid_lookup_cls_for is_static emh
isrtype G statT
wf_prog G
[PROOF STEP]
have is_cls_dynC: "is_class G dynC"
[PROOF STATE]
proof (prove)
using this:
G,statT \<turnstile> dynC valid_lookup_cls_for is_static emh
isrtype G statT
wf_prog G

goal (1 subgoal):
 1. is_class G dynC
[PROOF STEP]
by (auto dest: valid_lookup_cls_is_class)
[PROOF STATE]
proof (state)
this:
is_class G dynC

goal (1 subgoal):
 1. \<exists>dynM. dynlookup G statT dynC sig = Some dynM \<and> G \<turnstile>Methd sig dynM in dynC dyn_accessible_from accC
[PROOF STEP]
with emh wf dynC_prop isT_statT
[PROOF STATE]
proof (chain)
picking this:
emh \<in> mheads G accC statT sig
wf_prog G
G,statT \<turnstile> dynC valid_lookup_cls_for is_static emh
isrtype G statT
is_class G dynC
[PROOF STEP]
obtain dynM where
    "dynlookup G statT dynC sig = Some dynM"
[PROOF STATE]
proof (prove)
using this:
emh \<in> mheads G accC statT sig
wf_prog G
G,statT \<turnstile> dynC valid_lookup_cls_for is_static emh
isrtype G statT
is_class G dynC

goal (1 subgoal):
 1. (\<And>dynM. dynlookup G statT dynC sig = Some dynM \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by - (drule dynamic_mheadsD,auto)
[PROOF STATE]
proof (state)
this:
dynlookup G statT dynC sig = Some dynM

goal (1 subgoal):
 1. \<exists>dynM. dynlookup G statT dynC sig = Some dynM \<and> G \<turnstile>Methd sig dynM in dynC dyn_accessible_from accC
[PROOF STEP]
with  emh dynC_prop isT_statT wf
[PROOF STATE]
proof (chain)
picking this:
emh \<in> mheads G accC statT sig
G,statT \<turnstile> dynC valid_lookup_cls_for is_static emh
isrtype G statT
wf_prog G
dynlookup G statT dynC sig = Some dynM
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
emh \<in> mheads G accC statT sig
G,statT \<turnstile> dynC valid_lookup_cls_for is_static emh
isrtype G statT
wf_prog G
dynlookup G statT dynC sig = Some dynM

goal (1 subgoal):
 1. \<exists>dynM. dynlookup G statT dynC sig = Some dynM \<and> G \<turnstile>Methd sig dynM in dynC dyn_accessible_from accC
[PROOF STEP]
by (blast intro: dynlookup_access_prop)
[PROOF STATE]
proof (state)
this:
\<exists>dynM. dynlookup G statT dynC sig = Some dynM \<and> G \<turnstile>Methd sig dynM in dynC dyn_accessible_from accC

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in C_algebra) "x\<cdot>x = x \<longrightarrow> x\<^sup>\<star> = 1+x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<cdot> x = x \<longrightarrow> x\<^sup>\<star> = (1::'a) + x
[PROOF STEP]
oops


[STATEMENT]
lemma istate_\<Delta>1:
assumes B: "B vl vl1"
shows "\<Delta>1 istate vl istate vl1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Delta>1 istate vl istate vl1
[PROOF STEP]
using B
[PROOF STATE]
proof (prove)
using this:
B vl vl1

goal (1 subgoal):
 1. \<Delta>1 istate vl istate vl1
[PROOF STEP]
unfolding \<Delta>1_def B_def istate_def
[PROOF STATE]
proof (prove)
using this:
vl \<noteq> [] \<and> length vl = length vl1 \<and> distinct (map fst vl1) \<and> fst ` set vl1 \<subseteq> snd (hd vl) \<and> snd ` set vl1 = {snd (hd vl)}

goal (1 subgoal):
 1. (\<forall>cid. PID \<in>\<in> paperIDs \<lparr>confIDs = [], conf = \<lambda>confID. emptyConf, userIDs = [voronkovUserID], pass = \<lambda>uID. emptyPass, user = \<lambda>uID. emptyUser, roles = \<lambda>confID uID. [], paperIDs = \<lambda>confID. [], paper = \<lambda>papID. emptyPaper, pref = \<lambda>uID papID. NoPref, voronkov = voronkovUserID, news = \<lambda>confID. [], phase = \<lambda>confID. noPH\<rparr> cid \<longrightarrow> phase \<lparr>confIDs = [], conf = \<lambda>confID. emptyConf, userIDs = [voronkovUserID], pass = \<lambda>uID. emptyPass, user = \<lambda>uID. emptyUser, roles = \<lambda>confID uID. [], paperIDs = \<lambda>confID. [], paper = \<lambda>papID. emptyPaper, pref = \<lambda>uID papID. NoPref, voronkov = voronkovUserID, news = \<lambda>confID. [], phase = \<lambda>confID. noPH\<rparr> cid < revPH) \<and> \<lparr>confIDs = [], conf = \<lambda>confID. emptyConf, userIDs = [voronkovUserID], pass = \<lambda>uID. emptyPass, user = \<lambda>uID. emptyUser, roles = \<lambda>confID uID. [], paperIDs = \<lambda>confID. [], paper = \<lambda>papID. emptyPaper, pref = \<lambda>uID papID. NoPref, voronkov = voronkovUserID, news = \<lambda>confID. [], phase = \<lambda>confID. noPH\<rparr> = \<lparr>confIDs = [], conf = \<lambda>confID. emptyConf, userIDs = [voronkovUserID], pass = \<lambda>uID. emptyPass, user = \<lambda>uID. emptyUser, roles = \<lambda>confID uID. [], paperIDs = \<lambda>confID. [], paper = \<lambda>papID. emptyPaper, pref = \<lambda>uID papID. NoPref, voronkov = voronkovUserID, news = \<lambda>confID. [], phase = \<lambda>confID. noPH\<rparr> \<and> vl \<noteq> [] \<and> length vl = length vl1 \<and> distinct (map fst vl1) \<and> fst ` set vl1 \<subseteq> snd (hd vl) \<and> snd ` set vl1 = {snd (hd vl)}
[PROOF STEP]
by auto


[STATEMENT]
lemma VVV_cod_char:
    shows "VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
proof (cases "VVV.arr \<mu>\<nu>\<tau>")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
 2. \<not> VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
show "\<not> VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
using VVV.cod_def VVV.has_codomain_iff_arr VVV_arr_char B.VVV.cod_null
[PROOF STATE]
proof (prove)
using this:
VVV.cod ?f = (if VVV.codomains ?f \<noteq> {} then SOME b. b \<in> VVV.codomains ?f else VVV.null)
(VVV.codomains ?f \<noteq> {}) = VVV.arr ?f
VVV.arr ?\<mu>\<nu>\<tau> = B.VVV.arr (DN ?\<mu>\<nu>\<tau>)
B.VVV.cod B.VVV.null = B.VVV.null

goal (1 subgoal):
 1. \<not> VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))

goal (1 subgoal):
 1. VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
show "VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
assume \<mu>\<nu>\<tau>: "VVV.arr \<mu>\<nu>\<tau>"
[PROOF STATE]
proof (state)
this:
VVV.arr \<mu>\<nu>\<tau>

goal (1 subgoal):
 1. VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
have "VVV.cod \<mu>\<nu>\<tau> = (B.cod (fst \<mu>\<nu>\<tau>), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (snd (snd \<mu>\<nu>\<tau>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. VVV.cod \<mu>\<nu>\<tau> = (B.cod (fst \<mu>\<nu>\<tau>), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (snd (snd \<mu>\<nu>\<tau>)))
[PROOF STEP]
using \<mu>\<nu>\<tau> VVV.cod_char\<^sub>S\<^sub>b\<^sub>C VVV.arr_char\<^sub>S\<^sub>b\<^sub>C VV.arr_char\<^sub>S\<^sub>b\<^sub>C B.VVV.arr_char\<^sub>S\<^sub>b\<^sub>C B.VV.arr_char\<^sub>S\<^sub>b\<^sub>C
[PROOF STATE]
proof (prove)
using this:
VVV.arr \<mu>\<nu>\<tau>
VVV.cod ?f = (if VVV.arr ?f then B.VxVxV.cod ?f else B.VxVxV.null)
VVV.arr ?f = (B.arr (fst ?f) \<and> VV.arr (snd ?f) \<and> src (fst ?f) = trg (fst (snd ?f)))
VV.arr ?f = (B.arr (fst ?f) \<and> B.arr (snd ?f) \<and> src (fst ?f) = trg (snd ?f))
B.VVV.arr ?f = (B.arr (fst ?f) \<and> B.VV.arr (snd ?f) \<and> trg (fst ?f) = src (fst (snd ?f)))
B.VV.arr ?f = (B.arr (fst ?f) \<and> B.arr (snd ?f) \<and> trg (fst ?f) = src (snd ?f))

goal (1 subgoal):
 1. VVV.cod \<mu>\<nu>\<tau> = (B.cod (fst \<mu>\<nu>\<tau>), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (snd (snd \<mu>\<nu>\<tau>)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
VVV.cod \<mu>\<nu>\<tau> = (B.cod (fst \<mu>\<nu>\<tau>), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (snd (snd \<mu>\<nu>\<tau>)))

goal (1 subgoal):
 1. VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
VVV.cod \<mu>\<nu>\<tau> = (B.cod (fst \<mu>\<nu>\<tau>), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (snd (snd \<mu>\<nu>\<tau>)))

goal (1 subgoal):
 1. VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
have "... = UP (B.cod (snd (snd \<mu>\<nu>\<tau>)), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (fst \<mu>\<nu>\<tau>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (B.cod (fst \<mu>\<nu>\<tau>), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (snd (snd \<mu>\<nu>\<tau>))) = UP (B.cod (snd (snd \<mu>\<nu>\<tau>)), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (fst \<mu>\<nu>\<tau>))
[PROOF STEP]
by (metis (no_types, lifting) B.VV.arrI\<^sub>S\<^sub>b\<^sub>C B.VVV.arr_char\<^sub>S\<^sub>b\<^sub>C B.arr_cod VV.arrE VVV.arrE
              \<mu>\<nu>\<tau> fst_conv snd_conv src_cod trg_cod)
[PROOF STATE]
proof (state)
this:
(B.cod (fst \<mu>\<nu>\<tau>), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (snd (snd \<mu>\<nu>\<tau>))) = UP (B.cod (snd (snd \<mu>\<nu>\<tau>)), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (fst \<mu>\<nu>\<tau>))

goal (1 subgoal):
 1. VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(B.cod (fst \<mu>\<nu>\<tau>), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (snd (snd \<mu>\<nu>\<tau>))) = UP (B.cod (snd (snd \<mu>\<nu>\<tau>)), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (fst \<mu>\<nu>\<tau>))

goal (1 subgoal):
 1. VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
have "... = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UP (B.cod (snd (snd \<mu>\<nu>\<tau>)), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (fst \<mu>\<nu>\<tau>)) = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
using \<mu>\<nu>\<tau> B.VVV.cod_char\<^sub>S\<^sub>b\<^sub>C B.VVV.arr_char\<^sub>S\<^sub>b\<^sub>C B.VV.arr_char\<^sub>S\<^sub>b\<^sub>C VVV.arr_char\<^sub>S\<^sub>b\<^sub>C VV.arr_char\<^sub>S\<^sub>b\<^sub>C
[PROOF STATE]
proof (prove)
using this:
VVV.arr \<mu>\<nu>\<tau>
B.VVV.cod ?f = (if B.VVV.arr ?f then B.VxVxV.cod ?f else B.VxVxV.null)
B.VVV.arr ?f = (B.arr (fst ?f) \<and> B.VV.arr (snd ?f) \<and> trg (fst ?f) = src (fst (snd ?f)))
B.VV.arr ?f = (B.arr (fst ?f) \<and> B.arr (snd ?f) \<and> trg (fst ?f) = src (snd ?f))
VVV.arr ?f = (B.arr (fst ?f) \<and> VV.arr (snd ?f) \<and> src (fst ?f) = trg (fst (snd ?f)))
VV.arr ?f = (B.arr (fst ?f) \<and> B.arr (snd ?f) \<and> src (fst ?f) = trg (snd ?f))

goal (1 subgoal):
 1. UP (B.cod (snd (snd \<mu>\<nu>\<tau>)), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (fst \<mu>\<nu>\<tau>)) = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
UP (B.cod (snd (snd \<mu>\<nu>\<tau>)), B.cod (fst (snd \<mu>\<nu>\<tau>)), B.cod (fst \<mu>\<nu>\<tau>)) = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))

goal (1 subgoal):
 1. VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))

goal (1 subgoal):
 1. VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
VVV.arr \<mu>\<nu>\<tau> \<Longrightarrow> VVV.cod \<mu>\<nu>\<tau> = UP (B.VVV.cod (DN \<mu>\<nu>\<tau>))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma get_M_Mdocument_preserved10 [simp]:
  "(\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x))
    \<Longrightarrow> h \<turnstile> put_M\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr setter v \<rightarrow>\<^sub>h h' \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x); h \<turnstile> put_M document_ptr setter v \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> preserved (get_M object_ptr getter) h h'
[PROOF STEP]
apply(cases "cast document_ptr = object_ptr")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x); h \<turnstile> put_M document_ptr setter v \<rightarrow>\<^sub>h h'; cast document_ptr = object_ptr\<rbrakk> \<Longrightarrow> preserved (get_M object_ptr getter) h h'
 2. \<lbrakk>\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x); h \<turnstile> put_M document_ptr setter v \<rightarrow>\<^sub>h h'; cast document_ptr \<noteq> object_ptr\<rbrakk> \<Longrightarrow> preserved (get_M object_ptr getter) h h'
[PROOF STEP]
by(auto simp add: put_M_defs get_M_defs ObjectMonad.get_M_defs NodeMonad.get_M_defs get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def
      get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def preserved_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def bind_eq_Some_conv
      split: option.splits)


[STATEMENT]
lemma (in TC2) wt_instrs_xapp[trans]:
assumes wtis: "\<turnstile> is\<^sub>1 @ is\<^sub>2, xt [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2"
  and P_\<tau>s\<^sub>1: "\<forall>\<tau> \<in> set \<tau>s\<^sub>1. \<forall>ST' LT'. \<tau> = Some(ST',LT') \<longrightarrow>
    size ST \<le> size ST' \<and> P \<turnstile> Some (drop (size ST' - size ST) ST',LT') \<le>' ty\<^sub>i' ST E A"
  and is_\<tau>s: "size is\<^sub>1 = size \<tau>s\<^sub>1" and PC: "is_class P C" and ST_mxs: "size ST < mxs"
shows "\<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0,size is\<^sub>1 - 1,C,size is\<^sub>1,size ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2"
(*<*)(is "\<turnstile> ?is, xt@[?xte] [::] ?\<tau>s" is "\<turnstile> ?is, ?xt' [::] ?\<tau>s")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
let ?is = "is\<^sub>1 @ is\<^sub>2" and ?\<tau>s = "\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
let ?xte = "(0,size is\<^sub>1 - 1,C,size is\<^sub>1,size ST)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
let ?xt' = "xt @ [?xte]"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
have P_\<tau>s\<^sub>1': "\<And>\<tau>. \<tau> \<in> set \<tau>s\<^sub>1 \<Longrightarrow> (\<forall>ST' LT'. \<tau> = Some(ST',LT') \<longrightarrow>
     size ST \<le> size ST' \<and> P \<turnstile> Some (drop (size ST' - size ST) ST',LT') \<le>' ty\<^sub>i' ST E A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<tau>. \<tau> \<in> set \<tau>s\<^sub>1 \<Longrightarrow> \<forall>ST' LT'. \<tau> = \<lfloor>(ST', LT')\<rfloor> \<longrightarrow> length ST \<le> length ST' \<and> P \<turnstile> \<lfloor>(drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' ST E A
[PROOF STEP]
using P_\<tau>s\<^sub>1
[PROOF STATE]
proof (prove)
using this:
\<forall>\<tau>\<in>set \<tau>s\<^sub>1. \<forall>ST' LT'. \<tau> = \<lfloor>(ST', LT')\<rfloor> \<longrightarrow> length ST \<le> length ST' \<and> P \<turnstile> \<lfloor>(drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' ST E A

goal (1 subgoal):
 1. \<And>\<tau>. \<tau> \<in> set \<tau>s\<^sub>1 \<Longrightarrow> \<forall>ST' LT'. \<tau> = \<lfloor>(ST', LT')\<rfloor> \<longrightarrow> length ST \<le> length ST' \<and> P \<turnstile> \<lfloor>(drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' ST E A
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
?\<tau>3 \<in> set \<tau>s\<^sub>1 \<Longrightarrow> \<forall>ST' LT'. ?\<tau>3 = \<lfloor>(ST', LT')\<rfloor> \<longrightarrow> length ST \<le> length ST' \<and> P \<turnstile> \<lfloor>(drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' ST E A

goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
have "size ?is < size ?\<tau>s" and "pcs ?xt' \<subseteq> {0..<size ?is}"
    and P_pc: "\<And>pc. pc< size ?is \<Longrightarrow> P,T\<^sub>r,mxs,size ?\<tau>s,xt \<turnstile> ?is!pc,pc :: ?\<tau>s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (is\<^sub>1 @ is\<^sub>2) < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) &&& pcs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<subseteq> {0..<length (is\<^sub>1 @ is\<^sub>2)} &&& (\<And>pc. pc < length (is\<^sub>1 @ is\<^sub>2) \<Longrightarrow> P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! pc,pc :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
[PROOF STEP]
using wtis
[PROOF STATE]
proof (prove)
using this:
\<turnstile> is\<^sub>1 @ is\<^sub>2, xt [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2

goal (1 subgoal):
 1. length (is\<^sub>1 @ is\<^sub>2) < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) &&& pcs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<subseteq> {0..<length (is\<^sub>1 @ is\<^sub>2)} &&& (\<And>pc. pc < length (is\<^sub>1 @ is\<^sub>2) \<Longrightarrow> P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! pc,pc :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
[PROOF STEP]
by(simp_all add:wt_instrs_def)
[PROOF STATE]
proof (state)
this:
length (is\<^sub>1 @ is\<^sub>2) < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
pcs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<subseteq> {0..<length (is\<^sub>1 @ is\<^sub>2)}
?pc3 < length (is\<^sub>1 @ is\<^sub>2) \<Longrightarrow> P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! ?pc3,?pc3 :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2

goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length (is\<^sub>1 @ is\<^sub>2) < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
pcs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<subseteq> {0..<length (is\<^sub>1 @ is\<^sub>2)}
?pc3 < length (is\<^sub>1 @ is\<^sub>2) \<Longrightarrow> P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! ?pc3,?pc3 :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2

goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
length (is\<^sub>1 @ is\<^sub>2) < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
pcs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<subseteq> {0..<length (is\<^sub>1 @ is\<^sub>2)}
?pc3 < length (is\<^sub>1 @ is\<^sub>2) \<Longrightarrow> P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! ?pc3,?pc3 :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2

goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
fix pc
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
let ?mpc = "size ?\<tau>s" and ?i = "?is!pc" and ?t = "?\<tau>s!pc"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
assume "pc< size ?is"
[PROOF STATE]
proof (state)
this:
pc < length (is\<^sub>1 @ is\<^sub>2)

goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pc < length (is\<^sub>1 @ is\<^sub>2)
[PROOF STEP]
have wti: "P,T\<^sub>r,mxs,?mpc,xt \<turnstile> ?i,pc :: ?\<tau>s"
[PROOF STATE]
proof (prove)
using this:
pc < length (is\<^sub>1 @ is\<^sub>2)

goal (1 subgoal):
 1. P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! pc,pc :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
by(rule P_pc)
[PROOF STATE]
proof (state)
this:
P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! pc,pc :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2

goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! pc,pc :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
have app: "app ?i P mxs T\<^sub>r pc ?mpc xt ?t"
       and eff_ss: "\<And>pc' \<tau>'. (pc',\<tau>') \<in> set (eff ?i P pc xt (?\<tau>s!pc))
                           \<Longrightarrow> P \<turnstile> \<tau>' \<le>' ?\<tau>s!pc'"
[PROOF STATE]
proof (prove)
using this:
P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! pc,pc :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2

goal (1 subgoal):
 1. app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) &&& (\<And>pc' \<tau>'. (pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
by(fastforce simp add: wt_instr_def)+
[PROOF STATE]
proof (state)
this:
app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)
(?pc'3, ?\<tau>'3) \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> P \<turnstile> ?\<tau>'3 \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! ?pc'3

goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
have "app ?i P mxs T\<^sub>r pc ?mpc ?xt' ?t
             \<and> (\<forall>(pc',\<tau>') \<in> set (eff ?i P pc ?xt' ?t). P \<turnstile> \<tau>' \<le>' ?\<tau>s!pc')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
proof (cases ?t)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
 2. \<And>a. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>a\<rfloor> \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
case (Some \<tau>)
[PROOF STATE]
proof (state)
this:
(\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>\<tau>\<rfloor>

goal (2 subgoals):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
 2. \<And>a. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>a\<rfloor> \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
obtain ST' LT' where \<tau>: "\<tau> = (ST', LT')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ST' LT'. \<tau> = (ST', LT') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(cases \<tau>) simp
[PROOF STATE]
proof (state)
this:
\<tau> = (ST', LT')

goal (2 subgoals):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
 2. \<And>a. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>a\<rfloor> \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
have app\<^sub>i: "app\<^sub>i (?i,P,pc,mxs,T\<^sub>r,\<tau>)" and xcpt_app: "xcpt_app ?i P pc mxs xt \<tau>"
         and eff_pc: "\<And>pc' \<tau>'. (pc',\<tau>') \<in> set (eff ?i P pc xt ?t) \<Longrightarrow> pc' < ?mpc"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. app\<^sub>i ((is\<^sub>1 @ is\<^sub>2) ! pc, P, pc, mxs, T\<^sub>r, \<tau>) &&& xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs xt \<tau> &&& (\<And>pc' \<tau>'. (pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2))
[PROOF STEP]
using Some app
[PROOF STATE]
proof (prove)
using this:
(\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>\<tau>\<rfloor>
app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)

goal (1 subgoal):
 1. app\<^sub>i ((is\<^sub>1 @ is\<^sub>2) ! pc, P, pc, mxs, T\<^sub>r, \<tau>) &&& xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs xt \<tau> &&& (\<And>pc' \<tau>'. (pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2))
[PROOF STEP]
by(fastforce simp add: app_def)+
[PROOF STATE]
proof (state)
this:
app\<^sub>i ((is\<^sub>1 @ is\<^sub>2) ! pc, P, pc, mxs, T\<^sub>r, \<tau>)
xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs xt \<tau>
(?pc'3, ?\<tau>'3) \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> ?pc'3 < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)

goal (2 subgoals):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
 2. \<And>a. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>a\<rfloor> \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
have "xcpt_app ?i P pc mxs ?xt' \<tau>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
proof(cases "pc < length \<tau>s\<^sub>1 - 1")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
 2. \<not> pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> pc < length \<tau>s\<^sub>1 - 1

goal (2 subgoals):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
 2. \<not> pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> pc < length \<tau>s\<^sub>1 - 1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> pc < length \<tau>s\<^sub>1 - 1

goal (1 subgoal):
 1. xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
using Some \<tau> is_\<tau>s xcpt_app
[PROOF STATE]
proof (prove)
using this:
\<not> pc < length \<tau>s\<^sub>1 - 1
(\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>\<tau>\<rfloor>
\<tau> = (ST', LT')
length is\<^sub>1 = length \<tau>s\<^sub>1
xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs xt \<tau>

goal (1 subgoal):
 1. xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
by (clarsimp simp: xcpt_app_def relevant_entries_def
                             is_relevant_entry_def)
[PROOF STATE]
proof (state)
this:
xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
pc < length \<tau>s\<^sub>1 - 1

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pc < length \<tau>s\<^sub>1 - 1
[PROOF STEP]
have True': "pc < length \<tau>s\<^sub>1"
[PROOF STATE]
proof (prove)
using this:
pc < length \<tau>s\<^sub>1 - 1

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
pc < length \<tau>s\<^sub>1

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pc < length \<tau>s\<^sub>1
[PROOF STEP]
have "\<tau>s\<^sub>1 ! pc = ?t"
[PROOF STATE]
proof (prove)
using this:
pc < length \<tau>s\<^sub>1

goal (1 subgoal):
 1. \<tau>s\<^sub>1 ! pc = (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc
[PROOF STEP]
by(fastforce simp: nth_append)
[PROOF STATE]
proof (state)
this:
\<tau>s\<^sub>1 ! pc = (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<tau>s\<^sub>1 ! pc = (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
have \<tau>s\<^sub>1_pc: "\<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1
[PROOF STEP]
by(rule nth_mem[OF True'])
[PROOF STATE]
proof (state)
this:
\<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<tau>s\<^sub>1 ! pc = (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc
\<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<tau>s\<^sub>1 ! pc = (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc
\<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1

goal (1 subgoal):
 1. xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
using Some \<tau> PC ST_mxs xcpt_app P_\<tau>s\<^sub>1'[OF \<tau>s\<^sub>1_pc]
[PROOF STATE]
proof (prove)
using this:
\<tau>s\<^sub>1 ! pc = (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc
\<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1
(\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>\<tau>\<rfloor>
\<tau> = (ST', LT')
is_class P C
length ST < mxs
xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs xt \<tau>
\<forall>ST' LT'. \<tau>s\<^sub>1 ! pc = \<lfloor>(ST', LT')\<rfloor> \<longrightarrow> length ST \<le> length ST' \<and> P \<turnstile> \<lfloor>(drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' ST E A

goal (1 subgoal):
 1. xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
[PROOF STEP]
by (simp add: xcpt_app_def relevant_entries_def)
[PROOF STATE]
proof (state)
this:
xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>

goal (2 subgoals):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
 2. \<And>a. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>a\<rfloor> \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>

goal (2 subgoals):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
 2. \<And>a. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>a\<rfloor> \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>

goal (2 subgoals):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
 2. \<And>a. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>a\<rfloor> \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
fix pc' \<tau>'
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
 2. \<And>a. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>a\<rfloor> \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
assume efft: "(pc',\<tau>') \<in> set (eff ?i P pc ?xt' ?t)"
[PROOF STATE]
proof (state)
this:
(pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc))

goal (2 subgoals):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
 2. \<And>a. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>a\<rfloor> \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
have "pc' < ?mpc \<and> P \<turnstile> \<tau>' \<le>' ?\<tau>s!pc'" (is "?P1 \<and> ?P2")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
proof(cases "(pc',\<tau>') \<in> set (eff ?i P pc xt ?t)")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. (pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
 2. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
(pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc))

goal (2 subgoals):
 1. (pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
 2. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
have ?P1
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
[PROOF STEP]
using True
[PROOF STATE]
proof (prove)
using this:
(pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc))

goal (1 subgoal):
 1. pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
[PROOF STEP]
by(rule eff_pc)
[PROOF STATE]
proof (state)
this:
pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)

goal (2 subgoals):
 1. (pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
 2. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)

goal (2 subgoals):
 1. (pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
 2. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
have ?P2
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
using True
[PROOF STATE]
proof (prove)
using this:
(pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc))

goal (1 subgoal):
 1. P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
by(rule eff_ss)
[PROOF STATE]
proof (state)
this:
P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'

goal (2 subgoals):
 1. (pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
 2. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'

goal (1 subgoal):
 1. pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'

goal (1 subgoal):
 1. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
(pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc))

goal (1 subgoal):
 1. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc))
[PROOF STEP]
have xte: "(pc',\<tau>') \<in> set (xcpt_eff ?i P pc \<tau> [?xte])"
[PROOF STATE]
proof (prove)
using this:
(pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc))

goal (1 subgoal):
 1. (pc', \<tau>') \<in> set (xcpt_eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc \<tau> [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)])
[PROOF STEP]
using efft Some
[PROOF STATE]
proof (prove)
using this:
(pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc))
(pc', \<tau>') \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc))
(\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>\<tau>\<rfloor>

goal (1 subgoal):
 1. (pc', \<tau>') \<in> set (xcpt_eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc \<tau> [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)])
[PROOF STEP]
by(clarsimp simp: eff_def)
[PROOF STATE]
proof (state)
this:
(pc', \<tau>') \<in> set (xcpt_eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc \<tau> [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)])

goal (1 subgoal):
 1. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(pc', \<tau>') \<in> set (xcpt_eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc \<tau> [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)])
[PROOF STEP]
have ?P1
[PROOF STATE]
proof (prove)
using this:
(pc', \<tau>') \<in> set (xcpt_eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc \<tau> [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)])

goal (1 subgoal):
 1. pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
[PROOF STEP]
using Some \<tau> is_\<tau>s
[PROOF STATE]
proof (prove)
using this:
(pc', \<tau>') \<in> set (xcpt_eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc \<tau> [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)])
(\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>\<tau>\<rfloor>
\<tau> = (ST', LT')
length is\<^sub>1 = length \<tau>s\<^sub>1

goal (1 subgoal):
 1. pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
[PROOF STEP]
by(clarsimp simp: xcpt_eff_def relevant_entries_def split: if_split_asm)
[PROOF STATE]
proof (state)
this:
pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)

goal (1 subgoal):
 1. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)

goal (1 subgoal):
 1. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
have ?P2
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
proof(cases "pc < length \<tau>s\<^sub>1 - 1")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
 2. \<not> pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
case False': False
[PROOF STATE]
proof (state)
this:
\<not> pc < length \<tau>s\<^sub>1 - 1

goal (2 subgoals):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
 2. \<not> pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> pc < length \<tau>s\<^sub>1 - 1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> pc < length \<tau>s\<^sub>1 - 1

goal (1 subgoal):
 1. P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
using False Some \<tau> xte is_\<tau>s
[PROOF STATE]
proof (prove)
using this:
\<not> pc < length \<tau>s\<^sub>1 - 1
(pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc))
(\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>\<tau>\<rfloor>
\<tau> = (ST', LT')
(pc', \<tau>') \<in> set (xcpt_eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc \<tau> [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)])
length is\<^sub>1 = length \<tau>s\<^sub>1

goal (1 subgoal):
 1. P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
by(simp add: xcpt_eff_def relevant_entries_def is_relevant_entry_def)
[PROOF STATE]
proof (state)
this:
P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
pc < length \<tau>s\<^sub>1 - 1

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pc < length \<tau>s\<^sub>1 - 1
[PROOF STEP]
have True': "pc < length \<tau>s\<^sub>1"
[PROOF STATE]
proof (prove)
using this:
pc < length \<tau>s\<^sub>1 - 1

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
pc < length \<tau>s\<^sub>1

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
have \<tau>s\<^sub>1_pc: "\<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1
[PROOF STEP]
by(rule nth_mem[OF True'])
[PROOF STATE]
proof (state)
this:
\<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
have "P \<turnstile> \<lfloor>(Class C # drop (length ST' - length ST) ST', LT')\<rfloor>
                         \<le>' ty\<^sub>i' (Class C # ST) E A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<turnstile> \<lfloor>(Class C # drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' (Class C # ST) E A
[PROOF STEP]
using True' Some \<tau> P_\<tau>s\<^sub>1'[OF \<tau>s\<^sub>1_pc]
[PROOF STATE]
proof (prove)
using this:
pc < length \<tau>s\<^sub>1
(\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>\<tau>\<rfloor>
\<tau> = (ST', LT')
\<forall>ST' LT'. \<tau>s\<^sub>1 ! pc = \<lfloor>(ST', LT')\<rfloor> \<longrightarrow> length ST \<le> length ST' \<and> P \<turnstile> \<lfloor>(drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' ST E A

goal (1 subgoal):
 1. P \<turnstile> \<lfloor>(Class C # drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' (Class C # ST) E A
[PROOF STEP]
by (fastforce simp: nth_append ty\<^sub>i'_def)
[PROOF STATE]
proof (state)
this:
P \<turnstile> \<lfloor>(Class C # drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' (Class C # ST) E A

goal (1 subgoal):
 1. pc < length \<tau>s\<^sub>1 - 1 \<Longrightarrow> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
P \<turnstile> \<lfloor>(Class C # drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' (Class C # ST) E A
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
P \<turnstile> \<lfloor>(Class C # drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' (Class C # ST) E A

goal (1 subgoal):
 1. P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
using \<tau> xte is_\<tau>s
[PROOF STATE]
proof (prove)
using this:
P \<turnstile> \<lfloor>(Class C # drop (length ST' - length ST) ST', LT')\<rfloor> \<le>' ty\<^sub>i' (Class C # ST) E A
\<tau> = (ST', LT')
(pc', \<tau>') \<in> set (xcpt_eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc \<tau> [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)])
length is\<^sub>1 = length \<tau>s\<^sub>1

goal (1 subgoal):
 1. P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
by(simp add: xcpt_eff_def relevant_entries_def split: if_split_asm)
[PROOF STATE]
proof (state)
this:
P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'

goal (1 subgoal):
 1. (pc', \<tau>') \<notin> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc xt ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'

goal (1 subgoal):
 1. pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
pc' < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc'

goal (2 subgoals):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
 2. \<And>a. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>a\<rfloor> \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
(?pc'5, ?\<tau>'5) \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> ?pc'5 < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> ?\<tau>'5 \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! ?pc'5

goal (2 subgoals):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
 2. \<And>a. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>a\<rfloor> \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
(?pc'5, ?\<tau>'5) \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> ?pc'5 < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> ?\<tau>'5 \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! ?pc'5
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
(?pc'5, ?\<tau>'5) \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> ?pc'5 < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> ?\<tau>'5 \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! ?pc'5

goal (1 subgoal):
 1. app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
using Some app\<^sub>i
[PROOF STATE]
proof (prove)
using this:
xcpt_app ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc mxs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<tau>
(?pc'5, ?\<tau>'5) \<in> set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)) \<Longrightarrow> ?pc'5 < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) \<and> P \<turnstile> ?\<tau>'5 \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! ?pc'5
(\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = \<lfloor>\<tau>\<rfloor>
app\<^sub>i ((is\<^sub>1 @ is\<^sub>2) ! pc, P, pc, mxs, T\<^sub>r, \<tau>)

goal (1 subgoal):
 1. app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
by(fastforce simp add: app_def)
[PROOF STATE]
proof (state)
this:
app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')

goal (1 subgoal):
 1. (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc = None \<Longrightarrow> app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
qed simp
[PROOF STATE]
proof (state)
this:
app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')

goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')
[PROOF STEP]
have "P,T\<^sub>r,mxs,size ?\<tau>s,?xt' \<turnstile> ?is!pc,pc :: ?\<tau>s"
[PROOF STATE]
proof (prove)
using this:
app ((is\<^sub>1 @ is\<^sub>2) ! pc) P mxs T\<^sub>r pc (length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)) (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc) \<and> (\<forall>(pc', \<tau>')\<in>set (eff ((is\<^sub>1 @ is\<^sub>2) ! pc) P pc (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) ((\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc)). P \<turnstile> \<tau>' \<le>' (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2) ! pc')

goal (1 subgoal):
 1. P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! pc,pc :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
by(simp add: wt_instr_def)
[PROOF STATE]
proof (state)
this:
P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! pc,pc :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2

goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
?pc5 < length (is\<^sub>1 @ is\<^sub>2) \<Longrightarrow> P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! ?pc5,?pc5 :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2

goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
length (is\<^sub>1 @ is\<^sub>2) < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
pcs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<subseteq> {0..<length (is\<^sub>1 @ is\<^sub>2)}
?pc3 < length (is\<^sub>1 @ is\<^sub>2) \<Longrightarrow> P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! ?pc3,?pc3 :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
?pc5 < length (is\<^sub>1 @ is\<^sub>2) \<Longrightarrow> P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! ?pc5,?pc5 :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
length (is\<^sub>1 @ is\<^sub>2) < length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2)
pcs (xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)]) \<subseteq> {0..<length (is\<^sub>1 @ is\<^sub>2)}
?pc3 < length (is\<^sub>1 @ is\<^sub>2) \<Longrightarrow> P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! ?pc3,?pc3 :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
?pc5 < length (is\<^sub>1 @ is\<^sub>2) \<Longrightarrow> P,T\<^sub>r,mxs,length (\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2),xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] \<turnstile> (is\<^sub>1 @ is\<^sub>2) ! ?pc5,?pc5 :: \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2

goal (1 subgoal):
 1. \<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2
[PROOF STEP]
by(simp add:wt_instrs_def)
[PROOF STATE]
proof (state)
this:
\<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0, length is\<^sub>1 - 1, C, length is\<^sub>1, length ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2

goal:
No subgoals!
[PROOF STEP]
qed