[STATEMENT]
lemma While_sound_aux [rule_format]:
  "\<lbrakk> pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar;
   stable pre rely;  stable post rely; x \<in> cptn_mod \<rbrakk>
  \<Longrightarrow>  \<forall>s xs. x=(Some(While b P),s)#xs \<longrightarrow> x\<in>assum(pre, rely) \<longrightarrow> x \<in> comm (guar, post)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; x \<in> cptn_mod\<rbrakk> \<Longrightarrow> \<forall>s xs. x = (Some (While b P), s) # xs \<longrightarrow> x \<in> assum (pre, rely) \<longrightarrow> x \<in> comm (guar, post)
[PROOF STEP]
supply [[simproc del: defined_all]]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; x \<in> cptn_mod\<rbrakk> \<Longrightarrow> \<forall>s xs. x = (Some (While b P), s) # xs \<longrightarrow> x \<in> assum (pre, rely) \<longrightarrow> x \<in> comm (guar, post)
[PROOF STEP]
apply(erule cptn_mod.induct)
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<And>Pa s. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely\<rbrakk> \<Longrightarrow> \<forall>sa xs. [(Pa, s)] = (Some (While b P), sa) # xs \<longrightarrow> [(Pa, s)] \<in> assum (pre, rely) \<longrightarrow> [(Pa, s)] \<in> comm (guar, post)
 2. \<And>Pa t xs s. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Pa, t) # xs \<in> cptn_mod; \<forall>s xsa. (Pa, t) # xs = (Some (While b P), s) # xsa \<longrightarrow> (Pa, t) # xs \<in> assum (pre, rely) \<longrightarrow> (Pa, t) # xs \<in> comm (guar, post)\<rbrakk> \<Longrightarrow> \<forall>sa xsa. (Pa, s) # (Pa, t) # xs = (Some (While b P), sa) # xsa \<longrightarrow> (Pa, s) # (Pa, t) # xs \<in> assum (pre, rely) \<longrightarrow> (Pa, s) # (Pa, t) # xs \<in> comm (guar, post)
 3. \<And>Pa s t xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some Pa, s) -c\<rightarrow> (None, t); (None, t) # xs \<in> cptn_mod; \<forall>s xsa. (None, t) # xs = (Some (While b P), s) # xsa \<longrightarrow> (None, t) # xs \<in> assum (pre, rely) \<longrightarrow> (None, t) # xs \<in> comm (guar, post)\<rbrakk> \<Longrightarrow> \<forall>sa xsa. (Some Pa, s) # (None, t) # xs = (Some (While b P), sa) # xsa \<longrightarrow> (Some Pa, s) # (None, t) # xs \<in> assum (pre, rely) \<longrightarrow> (Some Pa, s) # (None, t) # xs \<in> comm (guar, post)
 4. \<And>P0 s ys ba P1. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P0, s) # ys \<in> cptn_mod; \<forall>sa xs. (Some P0, s) # ys = (Some (While b P), sa) # xs \<longrightarrow> (Some P0, s) # ys \<in> assum (pre, rely) \<longrightarrow> (Some P0, s) # ys \<in> comm (guar, post); s \<in> ba\<rbrakk> \<Longrightarrow> \<forall>sa xs. (Some (Cond ba P0 P1), s) # (Some P0, s) # ys = (Some (While b P), sa) # xs \<longrightarrow> (Some (Cond ba P0 P1), s) # (Some P0, s) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (Cond ba P0 P1), s) # (Some P0, s) # ys \<in> comm (guar, post)
 5. \<And>P1 s ys ba P0. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P1, s) # ys \<in> cptn_mod; \<forall>sa xs. (Some P1, s) # ys = (Some (While b P), sa) # xs \<longrightarrow> (Some P1, s) # ys \<in> assum (pre, rely) \<longrightarrow> (Some P1, s) # ys \<in> comm (guar, post); s \<notin> ba\<rbrakk> \<Longrightarrow> \<forall>sa xs. (Some (Cond ba P0 P1), s) # (Some P1, s) # ys = (Some (While b P), sa) # xs \<longrightarrow> (Some (Cond ba P0 P1), s) # (Some P1, s) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (Cond ba P0 P1), s) # (Some P1, s) # ys \<in> comm (guar, post)
 6. \<And>P0 s xs zs P1. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P0, s) # xs \<in> cptn_mod; \<forall>sa xsa. (Some P0, s) # xs = (Some (While b P), sa) # xsa \<longrightarrow> (Some P0, s) # xs \<in> assum (pre, rely) \<longrightarrow> (Some P0, s) # xs \<in> comm (guar, post); zs = map (lift P1) xs\<rbrakk> \<Longrightarrow> \<forall>sa xs. (Some (Seq P0 P1), s) # zs = (Some (While b P), sa) # xs \<longrightarrow> (Some (Seq P0 P1), s) # zs \<in> assum (pre, rely) \<longrightarrow> (Some (Seq P0 P1), s) # zs \<in> comm (guar, post)
 7. \<And>P0 s xs P1 ys zs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P0, s) # xs \<in> cptn_mod; \<forall>sa xsa. (Some P0, s) # xs = (Some (While b P), sa) # xsa \<longrightarrow> (Some P0, s) # xs \<in> assum (pre, rely) \<longrightarrow> (Some P0, s) # xs \<in> comm (guar, post); fst (last ((Some P0, s) # xs)) = None; (Some P1, snd (last ((Some P0, s) # xs))) # ys \<in> cptn_mod; \<forall>sa xsa. (Some P1, snd (last ((Some P0, s) # xs))) # ys = (Some (While b P), sa) # xsa \<longrightarrow> (Some P1, snd (last ((Some P0, s) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some P1, snd (last ((Some P0, s) # xs))) # ys \<in> comm (guar, post); zs = map (lift P1) xs @ ys\<rbrakk> \<Longrightarrow> \<forall>sa xs. (Some (Seq P0 P1), s) # zs = (Some (While b P), sa) # xs \<longrightarrow> (Some (Seq P0 P1), s) # zs \<in> assum (pre, rely) \<longrightarrow> (Some (Seq P0 P1), s) # zs \<in> comm (guar, post)
 8. \<And>Pa s xs ba zs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some Pa, s) # xs \<in> cptn_mod; \<forall>sa xsa. (Some Pa, s) # xs = (Some (While b P), sa) # xsa \<longrightarrow> (Some Pa, s) # xs \<in> assum (pre, rely) \<longrightarrow> (Some Pa, s) # xs \<in> comm (guar, post); s \<in> ba; zs = map (lift (While ba Pa)) xs\<rbrakk> \<Longrightarrow> \<forall>sa xs. (Some (While ba Pa), s) # (Some (Seq Pa (While ba Pa)), s) # zs = (Some (While b P), sa) # xs \<longrightarrow> (Some (While ba Pa), s) # (Some (Seq Pa (While ba Pa)), s) # zs \<in> assum (pre, rely) \<longrightarrow> (Some (While ba Pa), s) # (Some (Seq Pa (While ba Pa)), s) # zs \<in> comm (guar, post)
 9. \<And>Pa s xs ba zs ys. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some Pa, s) # xs \<in> cptn_mod; \<forall>sa xsa. (Some Pa, s) # xs = (Some (While b P), sa) # xsa \<longrightarrow> (Some Pa, s) # xs \<in> assum (pre, rely) \<longrightarrow> (Some Pa, s) # xs \<in> comm (guar, post); fst (last ((Some Pa, s) # xs)) = None; s \<in> ba; zs = map (lift (While ba Pa)) xs @ ys; (Some (While ba Pa), snd (last ((Some Pa, s) # xs))) # ys \<in> cptn_mod; \<forall>sa xsa. (Some (While ba Pa), snd (last ((Some Pa, s) # xs))) # ys = (Some (While b P), sa) # xsa \<longrightarrow> (Some (While ba Pa), snd (last ((Some Pa, s) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While ba Pa), snd (last ((Some Pa, s) # xs))) # ys \<in> comm (guar, post)\<rbrakk> \<Longrightarrow> \<forall>sa xs. (Some (While ba Pa), s) # (Some (Seq Pa (While ba Pa)), s) # zs = (Some (While b P), sa) # xs \<longrightarrow> (Some (While ba Pa), s) # (Some (Seq Pa (While ba Pa)), s) # zs \<in> assum (pre, rely) \<longrightarrow> (Some (While ba Pa), s) # (Some (Seq Pa (While ba Pa)), s) # zs \<in> comm (guar, post)
[PROOF STEP]
apply safe
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>Pa s sa xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; [(Some (While b P), sa)] \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> [(Some (While b P), sa)] \<in> comm (guar, post)
 2. \<And>Pa t xs s sa xsa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some (While b P), t) # xs \<in> cptn_mod; \<forall>s xsa. (Some (While b P), t) # xs = (Some (While b P), s) # xsa \<longrightarrow> (Some (While b P), t) # xs \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), t) # xs \<in> comm (guar, post); (Some (While b P), sa) # (Some (While b P), t) # xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (While b P), t) # xs \<in> comm (guar, post)
 3. \<And>Pa s t xs sa xsa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some (While b P), sa) -c\<rightarrow> (None, t); (None, t) # xs \<in> cptn_mod; \<forall>s xsa. (None, t) # xs = (Some (While b P), s) # xsa \<longrightarrow> (None, t) # xs \<in> assum (pre, rely) \<longrightarrow> (None, t) # xs \<in> comm (guar, post); (Some (While b P), sa) # (None, t) # xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (None, t) # xs \<in> comm (guar, post)
 4. \<And>Pa s xs ba zs sa xsa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; \<forall>s xsa. (Some P, sa) # xs = (Some (While b P), s) # xsa \<longrightarrow> (Some P, sa) # xs \<in> assum (pre, rely) \<longrightarrow> (Some P, sa) # xs \<in> comm (guar, post); sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 5. \<And>Pa s xs ba zs ys sa xsa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; \<forall>s xsa. (Some P, sa) # xs = (Some (While b P), s) # xsa \<longrightarrow> (Some P, sa) # xs \<in> assum (pre, rely) \<longrightarrow> (Some P, sa) # xs \<in> comm (guar, post); fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; \<forall>s xsa. (Some (While b P), snd (last ((Some P, sa) # xs))) # ys = (Some (While b P), s) # xsa \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply (simp_all del:last.simps)
\<comment> \<open>5 subgoals left\<close>
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; [(Some (While b P), sa)] \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> [(Some (While b P), sa)] \<in> comm (guar, post)
 2. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some (While b P), t) # xs \<in> cptn_mod; (Some (While b P), t) # xs \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), t) # xs \<in> comm (guar, post); (Some (While b P), sa) # (Some (While b P), t) # xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (While b P), t) # xs \<in> comm (guar, post)
 3. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some (While b P), sa) -c\<rightarrow> (None, t); (None, t) # xs \<in> cptn_mod; (Some (While b P), sa) # (None, t) # xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (None, t) # xs \<in> comm (guar, post)
 4. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(simp add:comm_def)
\<comment> \<open>4 subgoals left\<close>
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some (While b P), t) # xs \<in> cptn_mod; (Some (While b P), t) # xs \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), t) # xs \<in> comm (guar, post); (Some (While b P), sa) # (Some (While b P), t) # xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (While b P), t) # xs \<in> comm (guar, post)
 2. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some (While b P), sa) -c\<rightarrow> (None, t); (None, t) # xs \<in> cptn_mod; (Some (While b P), sa) # (None, t) # xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (None, t) # xs \<in> comm (guar, post)
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(rule etran_in_comm)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some (While b P), t) # xs \<in> cptn_mod; (Some (While b P), t) # xs \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), t) # xs \<in> comm (guar, post); (Some (While b P), sa) # (Some (While b P), t) # xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), t) # xs \<in> comm (guar, post)
 2. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some (While b P), sa) -c\<rightarrow> (None, t); (None, t) # xs \<in> cptn_mod; (Some (While b P), sa) # (None, t) # xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (None, t) # xs \<in> comm (guar, post)
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule mp)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some (While b P), t) # xs \<in> cptn_mod; (Some (While b P), sa) # (Some (While b P), t) # xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), t) # xs \<in> assum (pre, rely)
 2. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some (While b P), sa) -c\<rightarrow> (None, t); (None, t) # xs \<in> cptn_mod; (Some (While b P), sa) # (None, t) # xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (None, t) # xs \<in> comm (guar, post)
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule tl_of_assum_in_assum,simp)
\<comment> \<open>While-None\<close>
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some (While b P), sa) -c\<rightarrow> (None, t); (None, t) # xs \<in> cptn_mod; (Some (While b P), sa) # (None, t) # xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (None, t) # xs \<in> comm (guar, post)
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(ind_cases "((Some (While b P), s), None, t) \<in> ctran" for s t)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn_mod; (Some (While b P), sa) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; sa = t\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (None, t) # xs \<in> comm (guar, post)
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(simp add:comm_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn_mod; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; sa = t\<rbrakk> \<Longrightarrow> (xs = [] \<longrightarrow> t \<in> post) \<and> (xs \<noteq> [] \<longrightarrow> (\<forall>i<Suc (length xs). ((Some (While b P), t) # (None, t) # xs) ! i -c\<rightarrow> ((None, t) # xs) ! i \<longrightarrow> (snd (((Some (While b P), t) # (None, t) # xs) ! i), snd (((None, t) # xs) ! i)) \<in> guar) \<and> (fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post))
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(simp add:cptn_iff_cptn_mod [THEN sym])
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; sa = t\<rbrakk> \<Longrightarrow> (xs = [] \<longrightarrow> t \<in> post) \<and> (xs \<noteq> [] \<longrightarrow> (\<forall>i<Suc (length xs). ((Some (While b P), t) # (None, t) # xs) ! i -c\<rightarrow> ((None, t) # xs) ! i \<longrightarrow> (snd (((Some (While b P), t) # (None, t) # xs) ! i), snd (((None, t) # xs) ! i)) \<in> guar) \<and> (fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post))
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(rule conjI,clarify)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; [(None, t)] \<in> cptn; [(Some (While b P), t), (None, t)] \<in> assum (pre, rely); t \<notin> b\<rbrakk> \<Longrightarrow> t \<in> post
 2. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; sa = t\<rbrakk> \<Longrightarrow> xs \<noteq> [] \<longrightarrow> (\<forall>i<Suc (length xs). ((Some (While b P), t) # (None, t) # xs) ! i -c\<rightarrow> ((None, t) # xs) ! i \<longrightarrow> (snd (((Some (While b P), t) # (None, t) # xs) ! i), snd (((None, t) # xs) ! i)) \<in> guar) \<and> (fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post)
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(force simp add:assum_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; sa = t\<rbrakk> \<Longrightarrow> xs \<noteq> [] \<longrightarrow> (\<forall>i<Suc (length xs). ((Some (While b P), t) # (None, t) # xs) ! i -c\<rightarrow> ((None, t) # xs) ! i \<longrightarrow> (snd (((Some (While b P), t) # (None, t) # xs) ! i), snd (((None, t) # xs) ! i)) \<in> guar) \<and> (fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post)
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []\<rbrakk> \<Longrightarrow> (\<forall>i<Suc (length xs). ((Some (While b P), t) # (None, t) # xs) ! i -c\<rightarrow> ((None, t) # xs) ! i \<longrightarrow> (snd (((Some (While b P), t) # (None, t) # xs) ! i), snd (((None, t) # xs) ! i)) \<in> guar) \<and> (fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post)
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(rule conjI, clarify)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t xs sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; i < Suc (length xs); ((Some (While b P), t) # (None, t) # xs) ! i -c\<rightarrow> ((None, t) # xs) ! i\<rbrakk> \<Longrightarrow> (snd (((Some (While b P), t) # (None, t) # xs) ! i), snd (((None, t) # xs) ! i)) \<in> guar
 2. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(case_tac i,simp,simp)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t xs i nat. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; nat < length xs; ((None, t) # xs) ! nat -c\<rightarrow> xs ! nat; i = Suc nat\<rbrakk> \<Longrightarrow> (snd (((None, t) # xs) ! nat), snd (xs ! nat)) \<in> guar
 2. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(force simp add:not_ctran_None2)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(subgoal_tac "\<forall>i. Suc i < length ((None, t) # xs) \<longrightarrow> (((None, t) # xs) ! i, ((None, t) # xs) ! Suc i)\<in> etran")
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i. Suc i < length ((None, t) # xs) \<longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 2. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>i. Suc i < length ((None, t) # xs) \<longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>i. Suc i < length ((None, t) # xs) \<longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i
 2. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i. Suc i < length ((None, t) # xs) \<longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t xs sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; Suc i < length ((None, t) # xs)\<rbrakk> \<Longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i
 2. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i. Suc i < length ((None, t) # xs) \<longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(rule_tac m="length ((None, s) # xs)" in etran_or_ctran,simp+)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>t xs i ia. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; i < length xs; ia < length xs\<rbrakk> \<Longrightarrow> (((None, t) # xs) ! ia, xs ! ia) \<notin> ctran
 2. \<And>t xs sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; Suc i < length ((None, t) # xs)\<rbrakk> \<Longrightarrow> Suc i < length ((None, s) # xs)
 3. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i. Suc i < length ((None, t) # xs) \<longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 4. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule not_ctran_None2,simp)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t xs sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; Suc i < length ((None, t) # xs)\<rbrakk> \<Longrightarrow> Suc i < length ((None, s) # xs)
 2. \<And>t xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i. Suc i < length ((None, t) # xs) \<longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply simp+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(frule_tac j="0" and k="length ((None, s) # xs) - 1" and p=post in stability,simp+)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>t xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i\<rbrakk> \<Longrightarrow> t \<in> post
 2. \<And>t xs i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; Suc i < length ((None, t) # xs); ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i\<rbrakk> \<Longrightarrow> (snd (((None, t) # xs) ! i), snd (((None, t) # xs) ! Suc i)) \<in> rely
 3. \<And>t xs i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; 0 \<le> i \<and> i < length ((None, s) # xs) - 1\<rbrakk> \<Longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i
 4. \<And>t xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; snd (((None, t) # xs) ! (length ((None, s) # xs) - 1)) \<in> post \<and> fst (((None, t) # xs) ! 0) = fst (((None, t) # xs) ! (length ((None, s) # xs) - 1))\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 5. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 6. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(force simp add:assum_def subsetD)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>t xs i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; Suc i < length ((None, t) # xs); ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i\<rbrakk> \<Longrightarrow> (snd (((None, t) # xs) ! i), snd (((None, t) # xs) ! Suc i)) \<in> rely
 2. \<And>t xs i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; 0 \<le> i \<and> i < length ((None, s) # xs) - 1\<rbrakk> \<Longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i
 3. \<And>t xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; snd (((None, t) # xs) ! (length ((None, s) # xs) - 1)) \<in> post \<and> fst (((None, t) # xs) ! 0) = fst (((None, t) # xs) ! (length ((None, s) # xs) - 1))\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 4. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(simp add:assum_def)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>t xs i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; t \<in> pre \<and> (\<forall>i<Suc (length xs). ((Some (While b P), t) # (None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! i \<longrightarrow> (snd (((Some (While b P), t) # (None, t) # xs) ! i), snd (((None, t) # xs) ! i)) \<in> rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; i < length xs\<rbrakk> \<Longrightarrow> (snd (((None, t) # xs) ! i), snd (xs ! i)) \<in> rely
 2. \<And>t xs i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; 0 \<le> i \<and> i < length ((None, s) # xs) - 1\<rbrakk> \<Longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i
 3. \<And>t xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; snd (((None, t) # xs) ! (length ((None, s) # xs) - 1)) \<in> post \<and> fst (((None, t) # xs) ! 0) = fst (((None, t) # xs) ! (length ((None, s) # xs) - 1))\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 4. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>t xs i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; i < length xs; t \<in> pre; \<forall>i<Suc (length xs). ((Some (While b P), t) # (None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! i \<longrightarrow> (snd (((Some (While b P), t) # (None, t) # xs) ! i), snd (((None, t) # xs) ! i)) \<in> rely\<rbrakk> \<Longrightarrow> (snd (((None, t) # xs) ! i), snd (xs ! i)) \<in> rely
 2. \<And>t xs i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; 0 \<le> i \<and> i < length ((None, s) # xs) - 1\<rbrakk> \<Longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i
 3. \<And>t xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; snd (((None, t) # xs) ! (length ((None, s) # xs) - 1)) \<in> post \<and> fst (((None, t) # xs) ! 0) = fst (((None, t) # xs) ! (length ((None, s) # xs) - 1))\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 4. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule_tac x="i" in allE,simp)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>t xs i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; t \<notin> b; xs \<noteq> []; i < length xs; t \<in> pre; \<forall>i<Suc (length xs). ((Some (While b P), t) # (None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! i \<longrightarrow> (snd (((Some (While b P), t) # (None, t) # xs) ! i), snd (((None, t) # xs) ! i)) \<in> rely; ((None, t) # xs) ! i -e\<rightarrow> xs ! i\<rbrakk> \<Longrightarrow> (snd (((None, t) # xs) ! i), snd (xs ! i)) \<in> rely
 2. \<And>t xs i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; 0 \<le> i \<and> i < length ((None, s) # xs) - 1\<rbrakk> \<Longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i
 3. \<And>t xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; snd (((None, t) # xs) ! (length ((None, s) # xs) - 1)) \<in> post \<and> fst (((None, t) # xs) ! 0) = fst (((None, t) # xs) ! (length ((None, s) # xs) - 1))\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 4. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule_tac x="Suc i" in allE,simp)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>t xs i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; 0 \<le> i \<and> i < length ((None, s) # xs) - 1\<rbrakk> \<Longrightarrow> ((None, t) # xs) ! i -e\<rightarrow> ((None, t) # xs) ! Suc i
 2. \<And>t xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; snd (((None, t) # xs) ! (length ((None, s) # xs) - 1)) \<in> post \<and> fst (((None, t) # xs) ! 0) = fst (((None, t) # xs) ! (length ((None, s) # xs) - 1))\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; snd (((None, t) # xs) ! (length ((None, s) # xs) - 1)) \<in> post \<and> fst (((None, t) # xs) ! 0) = fst (((None, t) # xs) ! (length ((None, s) # xs) - 1))\<rbrakk> \<Longrightarrow> fst (last xs) = None \<longrightarrow> snd (last xs) \<in> post
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>t xs. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (None, t) # xs \<in> cptn; (Some (While b P), t) # (None, t) # xs \<in> assum (pre, rely); t \<notin> b; xs \<noteq> []; \<forall>i<length xs. ((None, t) # xs) ! i -e\<rightarrow> xs ! i; snd (((None, t) # xs) ! (length ((None, s) # xs) - 1)) \<in> post; fst (((None, t) # xs) ! 0) = fst (((None, t) # xs) ! (length ((None, s) # xs) - 1)); fst (last xs) = None\<rbrakk> \<Longrightarrow> snd (last xs) \<in> post
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply (simp add:last_length)
\<comment> \<open>WhileOne\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(rule ctran_in_comm,simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs \<in> comm (guar, post)
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(simp add:Cons_lift del:list.map)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> map (lift (While b P)) ((Some P, sa) # xs) \<in> comm (guar, post)
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(simp add:comm_def del:list.map)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (\<forall>i<length xs. lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i) \<longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar) \<and> (fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post)
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> \<forall>i<length xs. lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i) \<longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i)\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(case_tac "fst(((Some P, sa) # xs) ! i)")
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = None\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 2. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(case_tac "((Some P, sa) # xs) ! i")
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i a ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = None; ((Some P, sa) # xs) ! i = (a, ba)\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 2. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply (simp add:lift_def)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i a ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs \<in> assum (pre, rely); i < length xs; (Some (While b P), ba) -c\<rightarrow> (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)); a = None; ((Some P, sa) # xs) ! i = (None, ba)\<rbrakk> \<Longrightarrow> (ba, snd (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s))) \<in> guar
 2. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(ind_cases "(Some (While b P), ba) -c\<rightarrow> t" for ba t)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>xs sa i a ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs \<in> assum (pre, rely); i < length xs; a = None; ((Some P, sa) # xs) ! i = (None, ba); (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) = (None, ba); ba \<notin> b\<rbrakk> \<Longrightarrow> (ba, snd (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s))) \<in> guar
 2. \<And>xs sa i a ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs \<in> assum (pre, rely); i < length xs; a = None; ((Some P, sa) # xs) ! i = (None, ba); (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) = (Some (Seq P (While b P)), ba); ba \<in> b\<rbrakk> \<Longrightarrow> (ba, snd (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s))) \<in> guar
 3. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 4. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i a ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs \<in> assum (pre, rely); i < length xs; a = None; ((Some P, sa) # xs) ! i = (None, ba); (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) = (Some (Seq P (While b P)), ba); ba \<in> b\<rbrakk> \<Longrightarrow> (ba, snd (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s))) \<in> guar
 2. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(simp add:snd_lift del:list.map)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(simp only:com_validity_def cp_def cptn_iff_cptn_mod)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. {l. l ! 0 = (Some P, s) \<and> l \<in> cptn_mod} \<inter> assum (pre \<inter> b, rely) \<subseteq> comm (guar, pre); \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule_tac x=sa in allE)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; {l. l ! 0 = (Some P, sa) \<and> l \<in> cptn_mod} \<inter> assum (pre \<inter> b, rely) \<subseteq> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(drule_tac c="(Some P, sa) # xs" in subsetD)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (Some P, sa) # xs \<in> {l. l ! 0 = (Some P, sa) \<and> l \<in> cptn_mod} \<inter> assum (pre \<inter> b, rely)
 2. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply (simp add:assum_def del:list.map)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; sa \<in> pre \<and> (\<forall>i<Suc (length xs). ((Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs)) ! i -e\<rightarrow> lift (While b P) (((Some P, sa) # xs) ! i) \<longrightarrow> (snd (((Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs)) ! i), snd (lift (While b P) (((Some P, sa) # xs) ! i))) \<in> rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> \<forall>i<length xs. ((Some P, sa) # xs) ! i -e\<rightarrow> xs ! i \<longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> rely
 2. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i a ia. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; \<forall>i<Suc (length xs). ((Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs)) ! i -e\<rightarrow> lift (While b P) (((Some P, sa) # xs) ! i) \<longrightarrow> (snd (((Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs)) ! i), snd (lift (While b P) (((Some P, sa) # xs) ! i))) \<in> rely; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! ia), snd (xs ! ia)) \<in> rely
 2. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule_tac x="Suc ia" in allE,simp add:snd_lift del:list.map)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i a ia. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia; lift (While b P) (((Some P, sa) # xs) ! ia) -e\<rightarrow> lift (While b P) (xs ! ia) \<longrightarrow> (snd (((Some P, sa) # xs) ! ia), snd (xs ! ia)) \<in> rely\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! ia), snd (xs ! ia)) \<in> rely
 2. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule mp)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i a ia. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia\<rbrakk> \<Longrightarrow> lift (While b P) (((Some P, sa) # xs) ! ia) -e\<rightarrow> lift (While b P) (xs ! ia)
 2. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(case_tac "fst(((Some P, sa) # xs) ! ia)")
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>xs sa i a ia. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia; fst (((Some P, sa) # xs) ! ia) = None\<rbrakk> \<Longrightarrow> lift (While b P) (((Some P, sa) # xs) ! ia) -e\<rightarrow> lift (While b P) (xs ! ia)
 2. \<And>xs sa i a ia aa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia; fst (((Some P, sa) # xs) ! ia) = Some aa\<rbrakk> \<Longrightarrow> lift (While b P) (((Some P, sa) # xs) ! ia) -e\<rightarrow> lift (While b P) (xs ! ia)
 3. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 4. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule etranE,simp add:lift_def)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>xs sa i a ia Pa s t. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; i < length xs; (case ((Some P, sa) # xs) ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) -c\<rightarrow> (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)); fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; ia < length xs; Pa = None; ((Some P, sa) # xs) ! ia = (None, s); xs ! ia = (None, t)\<rbrakk> \<Longrightarrow> (Some (While b P), s) -e\<rightarrow> (Some (While b P), t)
 2. \<And>xs sa i a ia aa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia; fst (((Some P, sa) # xs) ! ia) = Some aa\<rbrakk> \<Longrightarrow> lift (While b P) (((Some P, sa) # xs) ! ia) -e\<rightarrow> lift (While b P) (xs ! ia)
 3. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 4. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(rule Env)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i a ia aa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia; fst (((Some P, sa) # xs) ! ia) = Some aa\<rbrakk> \<Longrightarrow> lift (While b P) (((Some P, sa) # xs) ! ia) -e\<rightarrow> lift (While b P) (xs ! ia)
 2. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule etranE,simp add:lift_def)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i a ia aa Pa s t. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; i < length xs; (case ((Some P, sa) # xs) ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) -c\<rightarrow> (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)); fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; ia < length xs; Pa = Some aa; ((Some P, sa) # xs) ! ia = (Some aa, s); xs ! ia = (Some aa, t)\<rbrakk> \<Longrightarrow> (Some (Seq aa (While b P)), s) -e\<rightarrow> (Some (Seq aa (While b P)), t)
 2. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(rule Env)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply (simp add:comm_def del:list.map)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; (\<forall>i<length xs. ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i \<longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar) \<and> (fst (if xs = [] then (Some P, sa) else last xs) = None \<longrightarrow> snd (if xs = [] then (Some P, sa) else last xs) \<in> pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; \<forall>i<length xs. ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i \<longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar; fst (if xs = [] then (Some P, sa) else last xs) = None \<longrightarrow> snd (if xs = [] then (Some P, sa) else last xs) \<in> pre\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule allE,erule impE,assumption)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; fst (if xs = [] then (Some P, sa) else last xs) = None \<longrightarrow> snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i \<longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule mp)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; fst (if xs = [] then (Some P, sa) else last xs) = None \<longrightarrow> snd (if xs = [] then (Some P, sa) else last xs) \<in> pre\<rbrakk> \<Longrightarrow> ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(case_tac "((Some P, sa) # xs) ! i")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a aa ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; fst (if xs = [] then (Some P, sa) else last xs) = None \<longrightarrow> snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (aa, ba)\<rbrakk> \<Longrightarrow> ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(case_tac "xs!i")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a aa ba ab baa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); i < length xs; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); fst (((Some P, sa) # xs) ! i) = Some a; fst (if xs = [] then (Some P, sa) else last xs) = None \<longrightarrow> snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (aa, ba); xs ! i = (ab, baa)\<rbrakk> \<Longrightarrow> ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(simp add:lift_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a aa ba ab baa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs \<in> assum (pre, rely); i < length xs; (Some (Seq a (While b P)), ba) -c\<rightarrow> (if ab = None then (Some (While b P), baa) else (Some (Seq (the ab) (While b P)), baa)); aa = Some a; fst (if xs = [] then (Some P, sa) else last xs) = None \<longrightarrow> snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (Some a, ba); xs ! i = (ab, baa)\<rbrakk> \<Longrightarrow> (Some a, ba) -c\<rightarrow> (ab, baa)
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(case_tac "fst(xs!i)")
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs sa i a aa ba ab baa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs \<in> assum (pre, rely); i < length xs; (Some (Seq a (While b P)), ba) -c\<rightarrow> (if ab = None then (Some (While b P), baa) else (Some (Seq (the ab) (While b P)), baa)); aa = Some a; fst (if xs = [] then (Some P, sa) else last xs) = None \<longrightarrow> snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (Some a, ba); xs ! i = (ab, baa); fst (xs ! i) = None\<rbrakk> \<Longrightarrow> (Some a, ba) -c\<rightarrow> (ab, baa)
 2. \<And>xs sa i a aa ba ab baa ac. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs \<in> assum (pre, rely); i < length xs; (Some (Seq a (While b P)), ba) -c\<rightarrow> (if ab = None then (Some (While b P), baa) else (Some (Seq (the ab) (While b P)), baa)); aa = Some a; fst (if xs = [] then (Some P, sa) else last xs) = None \<longrightarrow> snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (Some a, ba); xs ! i = (ab, baa); fst (xs ! i) = Some ac\<rbrakk> \<Longrightarrow> (Some a, ba) -c\<rightarrow> (ab, baa)
 3. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa i a aa ba ab baa ac. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs \<in> assum (pre, rely); i < length xs; (Some (Seq a (While b P)), ba) -c\<rightarrow> (if ab = None then (Some (While b P), baa) else (Some (Seq (the ab) (While b P)), baa)); aa = Some a; fst (if xs = [] then (Some P, sa) else last xs) = None \<longrightarrow> snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (Some a, ba); xs ! i = (ab, baa); fst (xs ! i) = Some ac\<rbrakk> \<Longrightarrow> (Some a, ba) -c\<rightarrow> (ab, baa)
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply force
\<comment> \<open>last=None\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None \<longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None\<rbrakk> \<Longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(subgoal_tac "(map (lift (While b P)) ((Some P, sa) # xs))\<noteq>[]")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None; map (lift (While b P)) ((Some P, sa) # xs) \<noteq> []\<rbrakk> \<Longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None\<rbrakk> \<Longrightarrow> map (lift (While b P)) ((Some P, sa) # xs) \<noteq> []
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(drule last_conv_nth)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None; last (map (lift (While b P)) ((Some P, sa) # xs)) = map (lift (While b P)) ((Some P, sa) # xs) ! (length (map (lift (While b P)) ((Some P, sa) # xs)) - 1)\<rbrakk> \<Longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None\<rbrakk> \<Longrightarrow> map (lift (While b P)) ((Some P, sa) # xs) \<noteq> []
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply (simp del:list.map)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); fst (lift (While b P) (((Some P, sa) # xs) ! length xs)) = None; last (map (lift (While b P)) ((Some P, sa) # xs)) = lift (While b P) (((Some P, sa) # xs) ! length xs)\<rbrakk> \<Longrightarrow> snd (lift (While b P) (((Some P, sa) # xs) ! length xs)) \<in> post
 2. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None\<rbrakk> \<Longrightarrow> map (lift (While b P)) ((Some P, sa) # xs) \<noteq> []
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(simp only:last_lift_not_None)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; sa \<in> b; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None\<rbrakk> \<Longrightarrow> map (lift (While b P)) ((Some P, sa) # xs) \<noteq> []
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply simp
\<comment> \<open>WhileMore\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(rule ctran_in_comm,simp del:last.simps)
\<comment> \<open>metiendo la hipotesis antes de dividir la conclusion.\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(subgoal_tac "(Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)
[PROOF STEP]
apply (simp del:last.simps)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(erule assum_after_body)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some P, sa) # xs \<in> cptn_mod
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some P, sa) # xs)) = None
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> sa \<in> b
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely) \<longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely)
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply (simp del:last.simps)+
\<comment> \<open>lo de antes.\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> comm (guar, post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> comm (guar, post)
[PROOF STEP]
apply(simp add:comm_def del:list.map last.simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> (\<forall>i<length xs + length ys. ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i \<longrightarrow> (snd (((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar) \<and> (fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post)
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> \<forall>i<length xs + length ys. ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i \<longrightarrow> (snd (((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i\<rbrakk> \<Longrightarrow> (snd (((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(simp only:Cons_lift_append)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(case_tac "i<length xs")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(simp add:nth_append del:list.map last.simps)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(case_tac "fst(((Some P, sa) # xs) ! i)")
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = None\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 2. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 3. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(case_tac "((Some P, sa) # xs) ! i")
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs ys sa i a ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = None; ((Some P, sa) # xs) ! i = (a, ba)\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 2. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 3. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply (simp add:lift_def del:last.simps)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs ys sa i a ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; (Some (While b P), ba) -c\<rightarrow> (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)); i < length xs; a = None; ((Some P, sa) # xs) ! i = (None, ba)\<rbrakk> \<Longrightarrow> (ba, snd (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s))) \<in> guar
 2. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 3. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(ind_cases "(Some (While b P), ba) -c\<rightarrow> t" for ba t)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>xs ys sa i a ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs; a = None; ((Some P, sa) # xs) ! i = (None, ba); (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) = (None, ba); ba \<notin> b\<rbrakk> \<Longrightarrow> (ba, snd (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s))) \<in> guar
 2. \<And>xs ys sa i a ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs; a = None; ((Some P, sa) # xs) ! i = (None, ba); (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) = (Some (Seq P (While b P)), ba); ba \<in> b\<rbrakk> \<Longrightarrow> (ba, snd (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s))) \<in> guar
 3. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 4. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs ys sa i a ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs; a = None; ((Some P, sa) # xs) ! i = (None, ba); (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) = (Some (Seq P (While b P)), ba); ba \<in> b\<rbrakk> \<Longrightarrow> (ba, snd (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s))) \<in> guar
 2. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 3. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (lift (While b P) (((Some P, sa) # xs) ! i)), snd (lift (While b P) (xs ! i))) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(simp add:snd_lift del:list.map last.simps)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(thin_tac " \<forall>i. i < length ys \<longrightarrow> P i" for P)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(simp only:com_validity_def cp_def cptn_iff_cptn_mod)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. {l. l ! 0 = (Some P, s) \<and> l \<in> cptn_mod} \<inter> assum (pre \<inter> b, rely) \<subseteq> comm (guar, pre); \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(erule_tac x=sa in allE)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; {l. l ! 0 = (Some P, sa) \<and> l \<in> cptn_mod} \<inter> assum (pre \<inter> b, rely) \<subseteq> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(drule_tac c="(Some P, sa) # xs" in subsetD)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> (Some P, sa) # xs \<in> {l. l ! 0 = (Some P, sa) \<and> l \<in> cptn_mod} \<inter> assum (pre \<inter> b, rely)
 2. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply (simp add:assum_def del:list.map last.simps)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; sa \<in> pre \<and> (\<forall>i<Suc (length xs + length ys). ((Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -e\<rightarrow> (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i \<longrightarrow> (snd (((Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i)) \<in> rely); snd (last ((Some P, sa) # xs)) \<in> pre \<and> (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -e\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a\<rbrakk> \<Longrightarrow> \<forall>i<length xs. ((Some P, sa) # xs) ! i -e\<rightarrow> xs ! i \<longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> rely
 2. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs ys sa i a ia. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; \<forall>i<Suc (length xs + length ys). ((Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -e\<rightarrow> (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i \<longrightarrow> (snd (((Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i)) \<in> rely; snd (last ((Some P, sa) # xs)) \<in> pre; \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -e\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> rely; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! ia), snd (xs ! ia)) \<in> rely
 2. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(erule_tac x="Suc ia" in allE,simp add:nth_append snd_lift del:list.map last.simps, erule mp)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs ys sa i a ia. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; snd (last ((Some P, sa) # xs)) \<in> pre; \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -e\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> rely; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia\<rbrakk> \<Longrightarrow> lift (While b P) (((Some P, sa) # xs) ! ia) -e\<rightarrow> lift (While b P) (xs ! ia)
 2. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(case_tac "fst(((Some P, sa) # xs) ! ia)")
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>xs ys sa i a ia. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; snd (last ((Some P, sa) # xs)) \<in> pre; \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -e\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> rely; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia; fst (((Some P, sa) # xs) ! ia) = None\<rbrakk> \<Longrightarrow> lift (While b P) (((Some P, sa) # xs) ! ia) -e\<rightarrow> lift (While b P) (xs ! ia)
 2. \<And>xs ys sa i a ia aa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; snd (last ((Some P, sa) # xs)) \<in> pre; \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -e\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> rely; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia; fst (((Some P, sa) # xs) ! ia) = Some aa\<rbrakk> \<Longrightarrow> lift (While b P) (((Some P, sa) # xs) ! ia) -e\<rightarrow> lift (While b P) (xs ! ia)
 3. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 4. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(erule etranE,simp add:lift_def)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>xs ys sa i a ia Pa s t. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; (case ((Some P, sa) # xs) ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) -c\<rightarrow> (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; \<forall>i<length ys. ((Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys) ! i -e\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys) ! i), snd (ys ! i)) \<in> rely; ia < length xs; Pa = None; ((Some P, sa) # xs) ! ia = (None, s); xs ! ia = (None, t)\<rbrakk> \<Longrightarrow> (Some (While b P), s) -e\<rightarrow> (Some (While b P), t)
 2. \<And>xs ys sa i a ia aa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; snd (last ((Some P, sa) # xs)) \<in> pre; \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -e\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> rely; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia; fst (((Some P, sa) # xs) ! ia) = Some aa\<rbrakk> \<Longrightarrow> lift (While b P) (((Some P, sa) # xs) ! ia) -e\<rightarrow> lift (While b P) (xs ! ia)
 3. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 4. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 5. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(rule Env)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs ys sa i a ia aa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; snd (last ((Some P, sa) # xs)) \<in> pre; \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -e\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> rely; ia < length xs; ((Some P, sa) # xs) ! ia -e\<rightarrow> xs ! ia; fst (((Some P, sa) # xs) ! ia) = Some aa\<rbrakk> \<Longrightarrow> lift (While b P) (((Some P, sa) # xs) ! ia) -e\<rightarrow> lift (While b P) (xs ! ia)
 2. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(erule etranE,simp add:lift_def)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs ys sa i a ia aa Pa s t. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; (case ((Some P, sa) # xs) ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) -c\<rightarrow> (case xs ! i of (Pa, s) \<Rightarrow> if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; sa \<in> pre; snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; \<forall>i<length ys. ((Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys) ! i -e\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys) ! i), snd (ys ! i)) \<in> rely; ia < length xs; Pa = Some aa; ((Some P, sa) # xs) ! ia = (Some aa, s); xs ! ia = (Some aa, t)\<rbrakk> \<Longrightarrow> (Some (Seq aa (While b P)), s) -e\<rightarrow> (Some (Seq aa (While b P)), t)
 2. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 3. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(rule Env)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; (Some P, sa) # xs \<in> comm (guar, pre)\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply (simp add:comm_def del:list.map)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> assum (pre, rely); fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; (\<forall>i<length xs. ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i \<longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar) \<and> snd (if xs = [] then (Some P, sa) else last xs) \<in> pre\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> assum (pre, rely); fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; \<forall>i<length xs. ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i \<longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar; snd (if xs = [] then (Some P, sa) else last xs) \<in> pre\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(erule allE,erule impE,assumption)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> assum (pre, rely); fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i \<longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! i), snd (xs ! i)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(erule mp)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> assum (pre, rely); fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; snd (if xs = [] then (Some P, sa) else last xs) \<in> pre\<rbrakk> \<Longrightarrow> ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(case_tac "((Some P, sa) # xs) ! i")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a aa ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> assum (pre, rely); fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (aa, ba)\<rbrakk> \<Longrightarrow> ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(case_tac "xs!i")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a aa ba ab baa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> assum (pre, rely); fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; lift (While b P) (((Some P, sa) # xs) ! i) -c\<rightarrow> lift (While b P) (xs ! i); i < length xs; fst (((Some P, sa) # xs) ! i) = Some a; snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (aa, ba); xs ! i = (ab, baa)\<rbrakk> \<Longrightarrow> ((Some P, sa) # xs) ! i -c\<rightarrow> xs ! i
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(simp add:lift_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a aa ba ab baa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> assum (pre, rely); fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; (Some (Seq a (While b P)), ba) -c\<rightarrow> (if ab = None then (Some (While b P), baa) else (Some (Seq (the ab) (While b P)), baa)); i < length xs; aa = Some a; snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (Some a, ba); xs ! i = (ab, baa)\<rbrakk> \<Longrightarrow> (Some a, ba) -c\<rightarrow> (ab, baa)
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(case_tac "fst(xs!i)")
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>xs ys sa i a aa ba ab baa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> assum (pre, rely); fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; (Some (Seq a (While b P)), ba) -c\<rightarrow> (if ab = None then (Some (While b P), baa) else (Some (Seq (the ab) (While b P)), baa)); i < length xs; aa = Some a; snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (Some a, ba); xs ! i = (ab, baa); fst (xs ! i) = None\<rbrakk> \<Longrightarrow> (Some a, ba) -c\<rightarrow> (ab, baa)
 2. \<And>xs ys sa i a aa ba ab baa ac. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> assum (pre, rely); fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; (Some (Seq a (While b P)), ba) -c\<rightarrow> (if ab = None then (Some (While b P), baa) else (Some (Seq (the ab) (While b P)), baa)); i < length xs; aa = Some a; snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (Some a, ba); xs ! i = (ab, baa); fst (xs ! i) = Some ac\<rbrakk> \<Longrightarrow> (Some a, ba) -c\<rightarrow> (ab, baa)
 3. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 4. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a aa ba ab baa ac. \<lbrakk>pre \<inter> - b \<subseteq> post; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (\<lambda>(Pa, s). if Pa = None then (Some (While b P), s) else (Some (Seq (the Pa) (While b P)), s)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) # ys \<in> assum (pre, rely); fst (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) = None \<longrightarrow> snd (if ys = [] then (Some (While b P), snd (if xs = [] then (Some P, sa) else last xs)) else last ys) \<in> post; (Some (Seq a (While b P)), ba) -c\<rightarrow> (if ab = None then (Some (While b P), baa) else (Some (Seq (the ab) (While b P)), baa)); i < length xs; aa = Some a; snd (if xs = [] then (Some P, sa) else last xs) \<in> pre; ((Some P, sa) # xs) ! i = (Some a, ba); xs ! i = (ab, baa); fst (xs ! i) = Some ac\<rbrakk> \<Longrightarrow> (Some a, ba) -c\<rightarrow> (ab, baa)
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply force
\<comment> \<open>\<open>i \<ge> length xs\<close>\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(subgoal_tac "i-length xs <length ys")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> i - length xs < length ys
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs\<rbrakk> \<Longrightarrow> i - length xs < length ys
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply arith
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(erule_tac x="i-length xs" in allE,clarify)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys; ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs) -c\<rightarrow> ys ! (i - length xs) \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs)), snd (ys ! (i - length xs))) \<in> guar\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(case_tac "i=length xs")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys; ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs) -c\<rightarrow> ys ! (i - length xs) \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs)), snd (ys ! (i - length xs))) \<in> guar; i = length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys; ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs) -c\<rightarrow> ys ! (i - length xs) \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs)), snd (ys ! (i - length xs))) \<in> guar; i \<noteq> length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply (simp add:nth_append snd_lift del:list.map last.simps)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; ys \<noteq> []; lift (While b P) (((Some P, sa) # xs) ! length xs) -c\<rightarrow> ys ! 0; (Some (While b P), snd (last ((Some P, sa) # xs))) -c\<rightarrow> ys ! 0 \<longrightarrow> (snd (last ((Some P, sa) # xs)), snd (ys ! 0)) \<in> guar; i = length xs\<rbrakk> \<Longrightarrow> (snd (((Some P, sa) # xs) ! length xs), snd (ys ! 0)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys; ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs) -c\<rightarrow> ys ! (i - length xs) \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs)), snd (ys ! (i - length xs))) \<in> guar; i \<noteq> length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(simp add:last_length del:last.simps)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # lift (While b P) (Some P, sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; ys \<noteq> []; lift (While b P) (last ((Some P, sa) # xs)) -c\<rightarrow> ys ! 0; (Some (While b P), snd (last ((Some P, sa) # xs))) -c\<rightarrow> ys ! 0 \<longrightarrow> (snd (last ((Some P, sa) # xs)), snd (ys ! 0)) \<in> guar; i = length xs\<rbrakk> \<Longrightarrow> (snd (last ((Some P, sa) # xs)), snd (ys ! 0)) \<in> guar
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys; ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs) -c\<rightarrow> ys ! (i - length xs) \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs)), snd (ys ! (i - length xs))) \<in> guar; i \<noteq> length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(erule mp)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # lift (While b P) (Some P, sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; ys \<noteq> []; lift (While b P) (last ((Some P, sa) # xs)) -c\<rightarrow> ys ! 0; i = length xs\<rbrakk> \<Longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) -c\<rightarrow> ys ! 0
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys; ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs) -c\<rightarrow> ys ! (i - length xs) \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs)), snd (ys ! (i - length xs))) \<in> guar; i \<noteq> length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(case_tac "last((Some P, sa) # xs)")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i a ba. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # lift (While b P) (Some P, sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; ys \<noteq> []; lift (While b P) (last ((Some P, sa) # xs)) -c\<rightarrow> ys ! 0; i = length xs; last ((Some P, sa) # xs) = (a, ba)\<rbrakk> \<Longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) -c\<rightarrow> ys ! 0
 2. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys; ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs) -c\<rightarrow> ys ! (i - length xs) \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs)), snd (ys ! (i - length xs))) \<in> guar; i \<noteq> length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(simp add:lift_def del:last.simps)
\<comment> \<open>\<open>i>length xs\<close>\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys; ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs) -c\<rightarrow> ys ! (i - length xs) \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs)), snd (ys ! (i - length xs))) \<in> guar; i \<noteq> length xs\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(case_tac "i-length xs")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys; ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs) -c\<rightarrow> ys ! (i - length xs) \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs)), snd (ys ! (i - length xs))) \<in> guar; i \<noteq> length xs; i - length xs = 0\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa i nat. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys; ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs) -c\<rightarrow> ys ! (i - length xs) \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs)), snd (ys ! (i - length xs))) \<in> guar; i \<noteq> length xs; i - length xs = Suc nat\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply arith
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa i nat. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; (map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i -c\<rightarrow> (map (lift (While b P)) xs @ ys) ! i; \<not> i < length xs; i - length xs < length ys; ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs) -c\<rightarrow> ys ! (i - length xs) \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! (i - length xs)), snd (ys ! (i - length xs))) \<in> guar; i \<noteq> length xs; i - length xs = Suc nat\<rbrakk> \<Longrightarrow> (snd ((map (lift (While b P)) ((Some P, sa) # xs) @ ys) ! i), snd ((map (lift (While b P)) xs @ ys) ! i)) \<in> guar
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(simp add:nth_append del:list.map last.simps)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa i nat. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; ys ! (i - Suc (length xs)) -c\<rightarrow> ys ! Suc nat; \<not> i < length xs; Suc nat < length ys; ys ! nat -c\<rightarrow> ys ! Suc nat \<longrightarrow> (snd (ys ! nat), snd (ys ! Suc nat)) \<in> guar; i \<noteq> length xs; i - length xs = Suc nat\<rbrakk> \<Longrightarrow> (snd (ys ! (i - Suc (length xs))), snd (ys ! Suc nat)) \<in> guar
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(rotate_tac -3)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa i nat. \<lbrakk>ys ! nat -c\<rightarrow> ys ! Suc nat \<longrightarrow> (snd (ys ! nat), snd (ys ! Suc nat)) \<in> guar; i \<noteq> length xs; i - length xs = Suc nat; pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; ys ! (i - Suc (length xs)) -c\<rightarrow> ys ! Suc nat; \<not> i < length xs; Suc nat < length ys\<rbrakk> \<Longrightarrow> (snd (ys ! (i - Suc (length xs))), snd (ys ! Suc nat)) \<in> guar
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(subgoal_tac "i- Suc (length xs)=nat")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i nat. \<lbrakk>ys ! nat -c\<rightarrow> ys ! Suc nat \<longrightarrow> (snd (ys ! nat), snd (ys ! Suc nat)) \<in> guar; i \<noteq> length xs; i - length xs = Suc nat; pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; ys ! (i - Suc (length xs)) -c\<rightarrow> ys ! Suc nat; \<not> i < length xs; Suc nat < length ys; i - Suc (length xs) = nat\<rbrakk> \<Longrightarrow> (snd (ys ! (i - Suc (length xs))), snd (ys ! Suc nat)) \<in> guar
 2. \<And>xs ys sa i nat. \<lbrakk>ys ! nat -c\<rightarrow> ys ! Suc nat \<longrightarrow> (snd (ys ! nat), snd (ys ! Suc nat)) \<in> guar; i \<noteq> length xs; i - length xs = Suc nat; pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; ys ! (i - Suc (length xs)) -c\<rightarrow> ys ! Suc nat; \<not> i < length xs; Suc nat < length ys\<rbrakk> \<Longrightarrow> i - Suc (length xs) = nat
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa i nat. \<lbrakk>ys ! nat -c\<rightarrow> ys ! Suc nat \<longrightarrow> (snd (ys ! nat), snd (ys ! Suc nat)) \<in> guar; i \<noteq> length xs; i - length xs = Suc nat; pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; ys ! (i - Suc (length xs)) -c\<rightarrow> ys ! Suc nat; \<not> i < length xs; Suc nat < length ys\<rbrakk> \<Longrightarrow> i - Suc (length xs) = nat
 2. \<And>xs ys sa i nat. \<lbrakk>ys ! nat -c\<rightarrow> ys ! Suc nat \<longrightarrow> (snd (ys ! nat), snd (ys ! Suc nat)) \<in> guar; i \<noteq> length xs; i - length xs = Suc nat; pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; ys ! (i - Suc (length xs)) -c\<rightarrow> ys ! Suc nat; \<not> i < length xs; Suc nat < length ys; i - Suc (length xs) = nat\<rbrakk> \<Longrightarrow> (snd (ys ! (i - Suc (length xs))), snd (ys ! Suc nat)) \<in> guar
 3. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply arith
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa i nat. \<lbrakk>ys ! nat -c\<rightarrow> ys ! Suc nat \<longrightarrow> (snd (ys ! nat), snd (ys ! Suc nat)) \<in> guar; i \<noteq> length xs; i - length xs = Suc nat; pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; i < length xs + length ys; ys ! (i - Suc (length xs)) -c\<rightarrow> ys ! Suc nat; \<not> i < length xs; Suc nat < length ys; i - Suc (length xs) = nat\<rbrakk> \<Longrightarrow> (snd (ys ! (i - Suc (length xs))), snd (ys ! Suc nat)) \<in> guar
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply simp
\<comment> \<open>last=None\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (\<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar) \<and> (fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post); (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely)\<rbrakk> \<Longrightarrow> fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None \<longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None\<rbrakk> \<Longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(case_tac ys)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = []\<rbrakk> \<Longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
 2. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(simp add:Cons_lift del:list.map last.simps)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> assum (pre, rely); fst (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) = None \<longrightarrow> snd (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) \<in> post; fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None; ys = []\<rbrakk> \<Longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 2. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(subgoal_tac "(map (lift (While b P)) ((Some P, sa) # xs))\<noteq>[]")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> assum (pre, rely); fst (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) = None \<longrightarrow> snd (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) \<in> post; fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None; ys = []; map (lift (While b P)) ((Some P, sa) # xs) \<noteq> []\<rbrakk> \<Longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> assum (pre, rely); fst (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) = None \<longrightarrow> snd (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) \<in> post; fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None; ys = []\<rbrakk> \<Longrightarrow> map (lift (While b P)) ((Some P, sa) # xs) \<noteq> []
 3. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(drule last_conv_nth)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> assum (pre, rely); fst (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) = None \<longrightarrow> snd (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) \<in> post; fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None; ys = []; last (map (lift (While b P)) ((Some P, sa) # xs)) = map (lift (While b P)) ((Some P, sa) # xs) ! (length (map (lift (While b P)) ((Some P, sa) # xs)) - 1)\<rbrakk> \<Longrightarrow> snd (last (map (lift (While b P)) ((Some P, sa) # xs))) \<in> post
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> assum (pre, rely); fst (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) = None \<longrightarrow> snd (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) \<in> post; fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None; ys = []\<rbrakk> \<Longrightarrow> map (lift (While b P)) ((Some P, sa) # xs) \<noteq> []
 3. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply (simp del:list.map)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (if xs = [] then (Some P, sa) else last xs) = None; sa \<in> b; [(Some (While b P), snd (if xs = [] then (Some P, sa) else last xs))] \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); [(Some (While b P), snd (if xs = [] then (Some P, sa) else last xs))] \<in> assum (pre, rely); fst (lift (While b P) (((Some P, sa) # xs) ! length xs)) = None; ys = []; last (map (lift (While b P)) ((Some P, sa) # xs)) = lift (While b P) (((Some P, sa) # xs) ! length xs)\<rbrakk> \<Longrightarrow> snd (lift (While b P) (((Some P, sa) # xs) ! length xs)) \<in> post
 2. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> assum (pre, rely); fst (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) = None \<longrightarrow> snd (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) \<in> post; fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None; ys = []\<rbrakk> \<Longrightarrow> map (lift (While b P)) ((Some P, sa) # xs) \<noteq> []
 3. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(simp only:last_lift_not_None)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> cptn_mod; (Some (While b P), sa) # map (lift (While b P)) ((Some P, sa) # xs) \<in> assum (pre, rely); [(Some (While b P), snd (last ((Some P, sa) # xs)))] \<in> assum (pre, rely); fst (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) = None \<longrightarrow> snd (last [(Some (While b P), snd (last ((Some P, sa) # xs)))]) \<in> post; fst (last (map (lift (While b P)) ((Some P, sa) # xs))) = None; ys = []\<rbrakk> \<Longrightarrow> map (lift (While b P)) ((Some P, sa) # xs) \<noteq> []
 2. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
[PROOF STEP]
apply(subgoal_tac "((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)\<noteq>[]")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list; (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<noteq> []\<rbrakk> \<Longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
 2. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<noteq> []
[PROOF STEP]
apply(drule last_conv_nth)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list; last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys) = ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys) ! (length ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys) - 1)\<rbrakk> \<Longrightarrow> snd (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) \<in> post
 2. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<noteq> []
[PROOF STEP]
apply (simp del:list.map last.simps)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> assum (pre, rely); \<forall>i<Suc (length list). ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i -c\<rightarrow> (a # list) ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i), snd ((a # list) ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) \<in> post; fst ((map (lift (While b P)) xs @ a # list) ! (length xs + length list)) = None; ys = a # list; last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list) = (map (lift (While b P)) xs @ a # list) ! (length xs + length list)\<rbrakk> \<Longrightarrow> snd ((map (lift (While b P)) xs @ a # list) ! (length xs + length list)) \<in> post
 2. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<noteq> []
[PROOF STEP]
apply(simp add:nth_append del:last.simps)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> assum (pre, rely); \<forall>i<Suc (length list). ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i -c\<rightarrow> (a # list) ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i), snd ((a # list) ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) \<in> post; fst ((a # list) ! length list) = None; ys = a # list; last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list) = (a # list) ! length list\<rbrakk> \<Longrightarrow> snd ((a # list) ! length list) \<in> post
 2. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<noteq> []
[PROOF STEP]
apply(rename_tac a list)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> assum (pre, rely); \<forall>i<Suc (length list). ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i -c\<rightarrow> (a # list) ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i), snd ((a # list) ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) \<in> post; fst ((a # list) ! length list) = None; ys = a # list; last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list) = (a # list) ! length list\<rbrakk> \<Longrightarrow> snd ((a # list) ! length list) \<in> post
 2. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<noteq> []
[PROOF STEP]
apply(subgoal_tac "((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)\<noteq>[]")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> assum (pre, rely); \<forall>i<Suc (length list). ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i -c\<rightarrow> (a # list) ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i), snd ((a # list) ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) \<in> post; fst ((a # list) ! length list) = None; ys = a # list; last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list) = (a # list) ! length list; (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<noteq> []\<rbrakk> \<Longrightarrow> snd ((a # list) ! length list) \<in> post
 2. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> assum (pre, rely); \<forall>i<Suc (length list). ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i -c\<rightarrow> (a # list) ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i), snd ((a # list) ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) \<in> post; fst ((a # list) ! length list) = None; ys = a # list; last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list) = (a # list) ! length list\<rbrakk> \<Longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<noteq> []
 3. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<noteq> []
[PROOF STEP]
apply(drule last_conv_nth)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> assum (pre, rely); \<forall>i<Suc (length list). ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i -c\<rightarrow> (a # list) ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i), snd ((a # list) ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) \<in> post; fst ((a # list) ! length list) = None; ys = a # list; last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list) = (a # list) ! length list; last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) = ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! (length ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) - 1)\<rbrakk> \<Longrightarrow> snd ((a # list) ! length list) \<in> post
 2. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> assum (pre, rely); \<forall>i<Suc (length list). ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i -c\<rightarrow> (a # list) ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i), snd ((a # list) ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) \<in> post; fst ((a # list) ! length list) = None; ys = a # list; last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list) = (a # list) ! length list\<rbrakk> \<Longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<noteq> []
 3. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<noteq> []
[PROOF STEP]
apply (simp del:list.map last.simps)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<in> assum (pre, rely); \<forall>i<Suc (length list). ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i -c\<rightarrow> (a # list) ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list) ! i), snd ((a # list) ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # a # list)) \<in> post; fst ((a # list) ! length list) = None; ys = a # list; last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ a # list) = (a # list) ! length list\<rbrakk> \<Longrightarrow> (Some (While b P), snd (last ((Some P, sa) # xs))) # a # list \<noteq> []
 2. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<noteq> []
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xs ys sa a list. \<lbrakk>pre \<inter> - b \<subseteq> post; \<Turnstile> P sat [pre \<inter> b, rely, guar, pre]; \<forall>s. (s, s) \<in> guar; RG_Hoare.stable pre rely; RG_Hoare.stable post rely; (Some P, sa) # xs \<in> cptn_mod; fst (last ((Some P, sa) # xs)) = None; sa \<in> b; (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> cptn_mod; (Some (While b P), sa) # (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<in> assum (pre, rely); (Some (While b P), snd (last ((Some P, sa) # xs))) # ys \<in> assum (pre, rely); \<forall>i<length ys. ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i -c\<rightarrow> ys ! i \<longrightarrow> (snd (((Some (While b P), snd (last ((Some P, sa) # xs))) # ys) ! i), snd (ys ! i)) \<in> guar; fst (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) = None \<longrightarrow> snd (last ((Some (While b P), snd (last ((Some P, sa) # xs))) # ys)) \<in> post; fst (last ((Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys)) = None; ys = a # list\<rbrakk> \<Longrightarrow> (Some (Seq P (While b P)), sa) # map (lift (While b P)) xs @ ys \<noteq> []
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done