[STATEMENT]
lemma get_M_Mshadow_root_preserved4a  [simp]:
  "h \<turnstile> put_M\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t shadow_root_ptr setter v \<rightarrow>\<^sub>h h'
   \<Longrightarrow> (\<And>x. getter (cast (setter (\<lambda>_. v) x)) = getter (cast x))
   \<Longrightarrow> preserved (get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t object_ptr getter) h h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>h \<turnstile> put_M shadow_root_ptr setter v \<rightarrow>\<^sub>h h'; \<And>x. getter (cast (cast (setter (\<lambda>_. v) x))) = getter (cast (cast x))\<rbrakk> \<Longrightarrow> preserved (get_M object_ptr getter) h h'
[PROOF STEP]
apply(cases "cast shadow_root_ptr \<noteq> object_ptr")[1]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>h \<turnstile> put_M shadow_root_ptr setter v \<rightarrow>\<^sub>h h'; \<And>x. getter (cast (cast (setter (\<lambda>_. v) x))) = getter (cast (cast x)); cast (cast shadow_root_ptr) \<noteq> object_ptr\<rbrakk> \<Longrightarrow> preserved (get_M object_ptr getter) h h'
 2. \<lbrakk>h \<turnstile> put_M shadow_root_ptr setter v \<rightarrow>\<^sub>h h'; \<And>x. getter (cast (cast (setter (\<lambda>_. v) x))) = getter (cast (cast x)); \<not> cast (cast shadow_root_ptr) \<noteq> object_ptr\<rbrakk> \<Longrightarrow> preserved (get_M object_ptr getter) h h'
[PROOF STEP]
by(auto simp add: put_M_defs get_M_defs get\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def put\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def
      ObjectMonad.get_M_defs preserved_def
      split: option.splits bind_splits dest: get_heap_E)


[STATEMENT]
lemma simple_cg_initial_invar :
  assumes "observable M1"
  shows "convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial
[PROOF STEP]
have "\<And> T . (L M1 \<inter> set T = (L M2 \<inter> set T)) \<Longrightarrow> finite_tree T \<Longrightarrow> (\<And>\<alpha> \<beta>. \<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<Longrightarrow> \<alpha> \<in> L M1 \<Longrightarrow> \<alpha> \<in> L M2 \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
fix T
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
assume "(L M1 \<inter> set T = (L M2 \<inter> set T))" and "finite_tree T"
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
finite_tree T

goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
finite_tree T
[PROOF STEP]
have "list.set (filter (is_in_language M1 (initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
finite_tree T

goal (1 subgoal):
 1. list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
[PROOF STEP]
unfolding is_in_language_iff[OF assms fsm_initial]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
finite_tree T

goal (1 subgoal):
 1. list.set (filter (\<lambda>io. io \<in> L M1) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
[PROOF STEP]
using sorted_list_of_sequences_in_tree_set[OF \<open>finite_tree T\<close>]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
finite_tree T
list.set (sorted_list_of_sequences_in_tree T) = Prefix_Tree.set T

goal (1 subgoal):
 1. list.set (filter (\<lambda>io. io \<in> L M1) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2

goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2

goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
have "(\<And>\<alpha> \<beta>. \<beta> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>) \<Longrightarrow> \<alpha> \<in> L M1 \<Longrightarrow> \<alpha> \<in> L M2 \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
using simple_cg_empty_invar
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar ?M1.0 ?M2.0 simple_cg_lookup simple_cg_empty

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
unfolding convergence_graph_lookup_invar_def
[PROOF STATE]
proof (prove)
using this:
\<forall>\<alpha>. \<alpha> \<in> L ?M1.0 \<longrightarrow> \<alpha> \<in> L ?M2.0 \<longrightarrow> \<alpha> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>) \<longrightarrow> converge ?M1.0 \<alpha> \<beta> \<and> converge ?M2.0 \<alpha> \<beta>)

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>
[PROOF STEP]
show "(\<And>\<alpha> \<beta>. \<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<Longrightarrow> \<alpha> \<in> L M1 \<Longrightarrow> \<alpha> \<in> L M2 \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)"
[PROOF STATE]
proof (prove)
using this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
using simple_cg_insert'_foldl_helper[of "(filter (is_in_language M1 (initial M1)) (sorted_list_of_sequences_in_tree T))" M1 M2]
[PROOF STATE]
proof (prove)
using this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>
\<lbrakk>list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2; \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup ?G \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>; ?\<beta> \<in> list.set (simple_cg_lookup (foldl simple_cg_insert' ?G (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T))) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
unfolding simple_cg_initial.simps
[PROOF STATE]
proof (prove)
using this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>
\<lbrakk>list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2; \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup ?G \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>; ?\<beta> \<in> list.set (simple_cg_lookup (foldl simple_cg_insert' ?G (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T))) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (foldl simple_cg_insert' simple_cg_empty (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T))) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set ?T = L M2 \<inter> Prefix_Tree.set ?T; finite_tree ?T; ?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 ?T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set ?T = L M2 \<inter> Prefix_Tree.set ?T; finite_tree ?T; ?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 ?T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set ?T = L M2 \<inter> Prefix_Tree.set ?T; finite_tree ?T; ?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 ?T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial
[PROOF STEP]
unfolding convergence_graph_initial_invar_def convergence_graph_lookup_invar_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set ?T = L M2 \<inter> Prefix_Tree.set ?T; finite_tree ?T; ?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 ?T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<forall>T. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T \<longrightarrow> finite_tree T \<longrightarrow> (\<forall>\<alpha>. \<alpha> \<in> L M1 \<longrightarrow> \<alpha> \<in> L M2 \<longrightarrow> \<alpha> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>))
[PROOF STEP]
using simple_cg_lookup_iff
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set ?T = L M2 \<inter> Prefix_Tree.set ?T; finite_tree ?T; ?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 ?T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>
(?\<beta> \<in> list.set (simple_cg_lookup ?G ?\<alpha>)) = (?\<beta> = ?\<alpha> \<or> (\<exists>x. x \<in> list.set ?G \<and> ts.memb ?\<alpha> x \<and> ts.memb ?\<beta> x))

goal (1 subgoal):
 1. \<forall>T. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T \<longrightarrow> finite_tree T \<longrightarrow> (\<forall>\<alpha>. \<alpha> \<in> L M1 \<longrightarrow> \<alpha> \<in> L M2 \<longrightarrow> \<alpha> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma simple_cg_initial_invar :
  assumes "observable M1"
  shows "convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial
[PROOF STEP]
have "\<And> T . (L M1 \<inter> set T = (L M2 \<inter> set T)) \<Longrightarrow> finite_tree T \<Longrightarrow> (\<And>\<alpha> \<beta>. \<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<Longrightarrow> \<alpha> \<in> L M1 \<Longrightarrow> \<alpha> \<in> L M2 \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
fix T
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
assume "(L M1 \<inter> set T = (L M2 \<inter> set T))" and "finite_tree T"
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
finite_tree T

goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
finite_tree T
[PROOF STEP]
have "list.set (filter (is_in_language M1 (initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
finite_tree T

goal (1 subgoal):
 1. list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
[PROOF STEP]
unfolding is_in_language_iff[OF assms fsm_initial]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
finite_tree T

goal (1 subgoal):
 1. list.set (filter (\<lambda>io. io \<in> L M1) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
[PROOF STEP]
using sorted_list_of_sequences_in_tree_set[OF \<open>finite_tree T\<close>]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
finite_tree T
list.set (sorted_list_of_sequences_in_tree T) = Prefix_Tree.set T

goal (1 subgoal):
 1. list.set (filter (\<lambda>io. io \<in> L M1) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2

goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2

goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
have "(\<And>\<alpha> \<beta>. \<beta> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>) \<Longrightarrow> \<alpha> \<in> L M1 \<Longrightarrow> \<alpha> \<in> L M2 \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
using simple_cg_empty_invar
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar ?M1.0 ?M2.0 simple_cg_lookup simple_cg_empty

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
unfolding convergence_graph_lookup_invar_def
[PROOF STATE]
proof (prove)
using this:
\<forall>\<alpha>. \<alpha> \<in> L ?M1.0 \<longrightarrow> \<alpha> \<in> L ?M2.0 \<longrightarrow> \<alpha> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>) \<longrightarrow> converge ?M1.0 \<alpha> \<beta> \<and> converge ?M2.0 \<alpha> \<beta>)

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<And>T. \<lbrakk>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T; finite_tree T\<rbrakk> \<Longrightarrow> (\<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>
[PROOF STEP]
show "(\<And>\<alpha> \<beta>. \<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<Longrightarrow> \<alpha> \<in> L M1 \<Longrightarrow> \<alpha> \<in> L M2 \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>)"
[PROOF STATE]
proof (prove)
using this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
using simple_cg_insert'_foldl_helper[of "(filter (is_in_language M1 (initial M1)) (sorted_list_of_sequences_in_tree T))" M1 M2]
[PROOF STATE]
proof (prove)
using this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>
\<lbrakk>list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2; \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup ?G \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>; ?\<beta> \<in> list.set (simple_cg_lookup (foldl simple_cg_insert' ?G (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T))) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
unfolding simple_cg_initial.simps
[PROOF STATE]
proof (prove)
using this:
list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup simple_cg_empty ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>
\<lbrakk>list.set (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T)) \<subseteq> L M1 \<inter> L M2; \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup ?G \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>; ?\<beta> \<in> list.set (simple_cg_lookup (foldl simple_cg_insert' ?G (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T))) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<And>\<alpha> \<beta>. \<lbrakk>\<beta> \<in> list.set (simple_cg_lookup (foldl simple_cg_insert' simple_cg_empty (filter (is_in_language M1 (FSM.initial M1)) (sorted_list_of_sequences_in_tree T))) \<alpha>); \<alpha> \<in> L M1; \<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set ?T = L M2 \<inter> Prefix_Tree.set ?T; finite_tree ?T; ?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 ?T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set ?T = L M2 \<inter> Prefix_Tree.set ?T; finite_tree ?T; ?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 ?T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set ?T = L M2 \<inter> Prefix_Tree.set ?T; finite_tree ?T; ?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 ?T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial
[PROOF STEP]
unfolding convergence_graph_initial_invar_def convergence_graph_lookup_invar_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set ?T = L M2 \<inter> Prefix_Tree.set ?T; finite_tree ?T; ?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 ?T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>

goal (1 subgoal):
 1. \<forall>T. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T \<longrightarrow> finite_tree T \<longrightarrow> (\<forall>\<alpha>. \<alpha> \<in> L M1 \<longrightarrow> \<alpha> \<in> L M2 \<longrightarrow> \<alpha> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>))
[PROOF STEP]
using simple_cg_lookup_iff
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>L M1 \<inter> Prefix_Tree.set ?T = L M2 \<inter> Prefix_Tree.set ?T; finite_tree ?T; ?\<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 ?T) ?\<alpha>); ?\<alpha> \<in> L M1; ?\<alpha> \<in> L M2\<rbrakk> \<Longrightarrow> converge M1 ?\<alpha> ?\<beta> \<and> converge M2 ?\<alpha> ?\<beta>
(?\<beta> \<in> list.set (simple_cg_lookup ?G ?\<alpha>)) = (?\<beta> = ?\<alpha> \<or> (\<exists>x. x \<in> list.set ?G \<and> ?\<alpha> |\<in>| x \<and> ?\<beta> |\<in>| x))

goal (1 subgoal):
 1. \<forall>T. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T \<longrightarrow> finite_tree T \<longrightarrow> (\<forall>\<alpha>. \<alpha> \<in> L M1 \<longrightarrow> \<alpha> \<in> L M2 \<longrightarrow> \<alpha> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<and> (\<forall>\<beta>. \<beta> \<in> list.set (simple_cg_lookup (simple_cg_initial M1 T) \<alpha>) \<longrightarrow> converge M1 \<alpha> \<beta> \<and> converge M2 \<alpha> \<beta>))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_initial_invar M1 M2 simple_cg_lookup simple_cg_initial

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma assign_eval\<^sub>w_load\<^sub>C:
  shows "(\<langle>x \<leftarrow> Load y, mds, mem\<rangle>\<^sub>C, \<langle>Stop, mds, mem (x := mem y)\<rangle>\<^sub>C) \<in> C.eval\<^sub>w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval_abv\<^sub>C \<langle>x \<leftarrow> Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
using C.unannotated[OF C.assign, where E="[]", simplified]
[PROOF STATE]
proof (prove)
using this:
eval_abv\<^sub>C \<langle>?x1 \<leftarrow> ?e1, ?mds, ?mem\<rangle>\<^sub>C \<langle>Stop, ?mds, ?mem(?x1 := ev\<^sub>A ?mem ?e1)\<rangle>\<^sub>C

goal (1 subgoal):
 1. eval_abv\<^sub>C \<langle>x \<leftarrow> Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
apply(drule_tac x=x in meta_spec)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>e mds mem. eval_abv\<^sub>C \<langle>x \<leftarrow> e, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := ev\<^sub>A mem e)\<rangle>\<^sub>C) \<Longrightarrow> eval_abv\<^sub>C \<langle>x \<leftarrow> Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
apply(drule_tac x="Load y" in meta_spec)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>mds mem. eval_abv\<^sub>C \<langle>x \<leftarrow> Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := ev\<^sub>A mem (Load y))\<rangle>\<^sub>C) \<Longrightarrow> eval_abv\<^sub>C \<langle>x \<leftarrow> Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
apply(drule_tac x=mds in meta_spec)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>mem. eval_abv\<^sub>C \<langle>x \<leftarrow> Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := ev\<^sub>A mem (Load y))\<rangle>\<^sub>C) \<Longrightarrow> eval_abv\<^sub>C \<langle>x \<leftarrow> Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
apply(drule_tac x=mem in meta_spec)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval_abv\<^sub>C \<langle>x \<leftarrow> Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := ev\<^sub>A mem (Load y))\<rangle>\<^sub>C \<Longrightarrow> eval_abv\<^sub>C \<langle>x \<leftarrow> Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma pt_fresh_star_bij:
  fixes  pi :: "'x prm"
  and     x :: "'a"
  and     a :: "'x set"
  and     b :: "'x list"
  assumes pt: "pt TYPE('a) TYPE('x)"
  and     at: "at TYPE('x)"
  shows "(pi\<bullet>a)\<sharp>*(pi\<bullet>x) = a\<sharp>*x"
  and   "(pi\<bullet>b)\<sharp>*(pi\<bullet>x) = b\<sharp>*x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (pi \<bullet> a) \<sharp>* (pi \<bullet> x) = a \<sharp>* x &&& (pi \<bullet> b) \<sharp>* (pi \<bullet> x) = b \<sharp>* x
[PROOF STEP]
apply(rule pt_fresh_star_bij_ineq(1))
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. pt TYPE('a) TYPE('x)
 2. pt TYPE('x) TYPE('x)
 3. at TYPE('x)
 4. cp TYPE('a) TYPE('x) TYPE('x)
 5. (pi \<bullet> b) \<sharp>* (pi \<bullet> x) = b \<sharp>* x
[PROOF STEP]
apply(rule pt)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. pt TYPE('x) TYPE('x)
 2. at TYPE('x)
 3. cp TYPE('a) TYPE('x) TYPE('x)
 4. (pi \<bullet> b) \<sharp>* (pi \<bullet> x) = b \<sharp>* x
[PROOF STEP]
apply(rule at_pt_inst)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. at TYPE('x)
 2. at TYPE('x)
 3. cp TYPE('a) TYPE('x) TYPE('x)
 4. (pi \<bullet> b) \<sharp>* (pi \<bullet> x) = b \<sharp>* x
[PROOF STEP]
apply(rule at)+
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. cp TYPE('a) TYPE('x) TYPE('x)
 2. (pi \<bullet> b) \<sharp>* (pi \<bullet> x) = b \<sharp>* x
[PROOF STEP]
apply(rule cp_pt_inst)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. pt TYPE('a) TYPE('x)
 2. at TYPE('x)
 3. (pi \<bullet> b) \<sharp>* (pi \<bullet> x) = b \<sharp>* x
[PROOF STEP]
apply(rule pt)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. at TYPE('x)
 2. (pi \<bullet> b) \<sharp>* (pi \<bullet> x) = b \<sharp>* x
[PROOF STEP]
apply(rule at)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (pi \<bullet> b) \<sharp>* (pi \<bullet> x) = b \<sharp>* x
[PROOF STEP]
apply(rule pt_fresh_star_bij_ineq(2))
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. pt TYPE('a) TYPE('x)
 2. pt TYPE('x) TYPE('x)
 3. at TYPE('x)
 4. cp TYPE('a) TYPE('x) TYPE('x)
[PROOF STEP]
apply(rule pt)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. pt TYPE('x) TYPE('x)
 2. at TYPE('x)
 3. cp TYPE('a) TYPE('x) TYPE('x)
[PROOF STEP]
apply(rule at_pt_inst)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. at TYPE('x)
 2. at TYPE('x)
 3. cp TYPE('a) TYPE('x) TYPE('x)
[PROOF STEP]
apply(rule at)+
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cp TYPE('a) TYPE('x) TYPE('x)
[PROOF STEP]
apply(rule cp_pt_inst)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. pt TYPE('a) TYPE('x)
 2. at TYPE('x)
[PROOF STEP]
apply(rule pt)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. at TYPE('x)
[PROOF STEP]
apply(rule at)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma simActBoundCases[consumes 1, case_names Input BoundOutput]:
  fixes P   :: pi
  and   a   :: subject
  and   x   :: name
  and   Q'  :: pi
  and   C   :: "'a::fs_name"
  and   Rel :: "(pi \<times> pi) set"

  assumes EqvtRel: "eqvt Rel"
  and     DerInput: "\<And>b. a = InputS b \<Longrightarrow> (\<exists>P''. \<forall>u. \<exists>P'. (P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P') \<and> (P', Q'[x::=u]) \<in> Rel)"
  and     DerBoundOutput: "\<And>b. a = BoundOutputS b \<Longrightarrow> (\<exists>P'. (P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P') \<and> (P', Q') \<in> Rel)"

  shows "weakSimAct P (a\<guillemotleft>x\<guillemotright> \<prec> Q') P Rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. weakSimAct P (a\<guillemotleft>x\<guillemotright> \<prec> Q') P Rel
[PROOF STEP]
proof(simp add: weakSimAct_def fresh_prod, auto)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<\<nu>xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^aa<\<nu>xa> \<prec> P' \<and> (P', Q'a) \<in> Rel
 2. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
fix Q'' b y
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<\<nu>xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^aa<\<nu>xa> \<prec> P' \<and> (P', Q'a) \<in> Rel
 2. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
assume Eq: "a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<\<nu>y> \<prec> Q''"
[PROOF STATE]
proof (state)
this:
a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<\<nu>y> \<prec> Q''

goal (2 subgoals):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<\<nu>xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^aa<\<nu>xa> \<prec> P' \<and> (P', Q'a) \<in> Rel
 2. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
assume yFreshP: "y \<sharp> P"
[PROOF STATE]
proof (state)
this:
y \<sharp> P

goal (2 subgoals):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<\<nu>xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^aa<\<nu>xa> \<prec> P' \<and> (P', Q'a) \<in> Rel
 2. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
from Eq
[PROOF STATE]
proof (chain)
picking this:
a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<\<nu>y> \<prec> Q''
[PROOF STEP]
have "a = BoundOutputS b"
[PROOF STATE]
proof (prove)
using this:
a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<\<nu>y> \<prec> Q''

goal (1 subgoal):
 1. a = BoundOutputS b
[PROOF STEP]
by(simp add: residual.inject)
[PROOF STATE]
proof (state)
this:
a = BoundOutputS b

goal (2 subgoals):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<\<nu>xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^aa<\<nu>xa> \<prec> P' \<and> (P', Q'a) \<in> Rel
 2. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
from yFreshP DerBoundOutput[OF this] Eq
[PROOF STATE]
proof (chain)
picking this:
y \<sharp> P
\<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P' \<and> (P', Q') \<in> Rel
a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<\<nu>y> \<prec> Q''
[PROOF STEP]
show "\<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel"
[PROOF STATE]
proof (prove)
using this:
y \<sharp> P
\<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P' \<and> (P', Q') \<in> Rel
a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<\<nu>y> \<prec> Q''

goal (1 subgoal):
 1. \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
proof(cases "x=y", auto simp add: residual.inject name_abs_eq)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>P'. \<lbrakk>x \<noteq> y; y \<sharp> P; a = BoundOutputS b; P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'; (P', [(x, y)] \<bullet> Q'') \<in> Rel; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
fix P'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>P'. \<lbrakk>x \<noteq> y; y \<sharp> P; a = BoundOutputS b; P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'; (P', [(x, y)] \<bullet> Q'') \<in> Rel; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
assume PTrans: "P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'"
[PROOF STATE]
proof (state)
this:
P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'

goal (1 subgoal):
 1. \<And>P'. \<lbrakk>x \<noteq> y; y \<sharp> P; a = BoundOutputS b; P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'; (P', [(x, y)] \<bullet> Q'') \<in> Rel; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
assume P'RelQ': "(P', ([(x, y)] \<bullet> Q'')) \<in> Rel"
[PROOF STATE]
proof (state)
this:
(P', [(x, y)] \<bullet> Q'') \<in> Rel

goal (1 subgoal):
 1. \<And>P'. \<lbrakk>x \<noteq> y; y \<sharp> P; a = BoundOutputS b; P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'; (P', [(x, y)] \<bullet> Q'') \<in> Rel; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
assume xineqy: "x \<noteq> y"
[PROOF STATE]
proof (state)
this:
x \<noteq> y

goal (1 subgoal):
 1. \<And>P'. \<lbrakk>x \<noteq> y; y \<sharp> P; a = BoundOutputS b; P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'; (P', [(x, y)] \<bullet> Q'') \<in> Rel; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
with PTrans yFreshP
[PROOF STATE]
proof (chain)
picking this:
P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'
y \<sharp> P
x \<noteq> y
[PROOF STEP]
have yFreshP': "y \<sharp> P'"
[PROOF STATE]
proof (prove)
using this:
P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'
y \<sharp> P
x \<noteq> y

goal (1 subgoal):
 1. y \<sharp> P'
[PROOF STEP]
by(force intro: freshTransition)
[PROOF STATE]
proof (state)
this:
y \<sharp> P'

goal (1 subgoal):
 1. \<And>P'. \<lbrakk>x \<noteq> y; y \<sharp> P; a = BoundOutputS b; P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'; (P', [(x, y)] \<bullet> Q'') \<in> Rel; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
hence "b<\<nu>x> \<prec> P' = b<\<nu>y> \<prec> [(x, y)] \<bullet> P'"
[PROOF STATE]
proof (prove)
using this:
y \<sharp> P'

goal (1 subgoal):
 1. b<\<nu>x> \<prec> P' = b<\<nu>y> \<prec> [(x, y)] \<bullet> P'
[PROOF STEP]
by(rule alphaBoundResidual)
[PROOF STATE]
proof (state)
this:
b<\<nu>x> \<prec> P' = b<\<nu>y> \<prec> [(x, y)] \<bullet> P'

goal (1 subgoal):
 1. \<And>P'. \<lbrakk>x \<noteq> y; y \<sharp> P; a = BoundOutputS b; P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'; (P', [(x, y)] \<bullet> Q'') \<in> Rel; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
b<\<nu>x> \<prec> P' = b<\<nu>y> \<prec> [(x, y)] \<bullet> P'

goal (1 subgoal):
 1. \<And>P'. \<lbrakk>x \<noteq> y; y \<sharp> P; a = BoundOutputS b; P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'; (P', [(x, y)] \<bullet> Q'') \<in> Rel; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
have "([(x, y)] \<bullet> P', Q'') \<in> Rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ([(x, y)] \<bullet> P', Q'') \<in> Rel
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ([(x, y)] \<bullet> P', Q'') \<in> Rel
[PROOF STEP]
from EqvtRel P'RelQ'
[PROOF STATE]
proof (chain)
picking this:
eqvt Rel
(P', [(x, y)] \<bullet> Q'') \<in> Rel
[PROOF STEP]
have "([(x, y)] \<bullet> P', [(x, y)] \<bullet> ([(x, y)] \<bullet> Q''))\<in> Rel"
[PROOF STATE]
proof (prove)
using this:
eqvt Rel
(P', [(x, y)] \<bullet> Q'') \<in> Rel

goal (1 subgoal):
 1. ([(x, y)] \<bullet> P', [(x, y)] \<bullet> [(x, y)] \<bullet> Q'') \<in> Rel
[PROOF STEP]
by(rule eqvtRelI)
[PROOF STATE]
proof (state)
this:
([(x, y)] \<bullet> P', [(x, y)] \<bullet> [(x, y)] \<bullet> Q'') \<in> Rel

goal (1 subgoal):
 1. ([(x, y)] \<bullet> P', Q'') \<in> Rel
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
([(x, y)] \<bullet> P', [(x, y)] \<bullet> [(x, y)] \<bullet> Q'') \<in> Rel

goal (1 subgoal):
 1. ([(x, y)] \<bullet> P', Q'') \<in> Rel
[PROOF STEP]
by(simp add: name_calc)
[PROOF STATE]
proof (state)
this:
([(x, y)] \<bullet> P', Q'') \<in> Rel

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
([(x, y)] \<bullet> P', Q'') \<in> Rel

goal (1 subgoal):
 1. \<And>P'. \<lbrakk>x \<noteq> y; y \<sharp> P; a = BoundOutputS b; P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'; (P', [(x, y)] \<bullet> Q'') \<in> Rel; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
b<\<nu>x> \<prec> P' = b<\<nu>y> \<prec> [(x, y)] \<bullet> P'
([(x, y)] \<bullet> P', Q'') \<in> Rel
[PROOF STEP]
show "\<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel"
[PROOF STATE]
proof (prove)
using this:
b<\<nu>x> \<prec> P' = b<\<nu>y> \<prec> [(x, y)] \<bullet> P'
([(x, y)] \<bullet> P', Q'') \<in> Rel

goal (1 subgoal):
 1. \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
using PTrans
[PROOF STATE]
proof (prove)
using this:
b<\<nu>x> \<prec> P' = b<\<nu>y> \<prec> [(x, y)] \<bullet> P'
([(x, y)] \<bullet> P', Q'') \<in> Rel
P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>x> \<prec> P'

goal (1 subgoal):
 1. \<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>P'. P \<Longrightarrow>\<^sub>l\<^sup>^b<\<nu>y> \<prec> P' \<and> (P', Q'') \<in> Rel

goal (1 subgoal):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
fix Q'' b y u
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
assume Eq: "a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<y> \<prec> Q''"
[PROOF STATE]
proof (state)
this:
a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<y> \<prec> Q''

goal (1 subgoal):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
assume yFreshP: "y \<sharp> P"
[PROOF STATE]
proof (state)
this:
y \<sharp> P

goal (1 subgoal):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
from Eq
[PROOF STATE]
proof (chain)
picking this:
a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<y> \<prec> Q''
[PROOF STEP]
have "a = InputS b"
[PROOF STATE]
proof (prove)
using this:
a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<y> \<prec> Q''

goal (1 subgoal):
 1. a = InputS b
[PROOF STEP]
by(simp add: residual.inject)
[PROOF STATE]
proof (state)
this:
a = InputS b

goal (1 subgoal):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
from DerInput[OF this]
[PROOF STATE]
proof (chain)
picking this:
\<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', Q'[x::=u]) \<in> Rel
[PROOF STEP]
obtain P'' where L1: "\<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and>
                                                        (P', Q'[x::=u]) \<in> Rel"
[PROOF STATE]
proof (prove)
using this:
\<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', Q'[x::=u]) \<in> Rel

goal (1 subgoal):
 1. (\<And>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', Q'[x::=u]) \<in> Rel \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', Q'[x::=u]) \<in> Rel

goal (1 subgoal):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
have "\<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in ([(x, y)] \<bullet> P'')\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
proof(rule allI)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
fix u
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
from L1 Eq
[PROOF STATE]
proof (chain)
picking this:
\<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', Q'[x::=u]) \<in> Rel
a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<y> \<prec> Q''
[PROOF STEP]
show "\<exists>P'. P \<Longrightarrow>\<^sub>lu in ([(x, y)] \<bullet> P'')\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel"
[PROOF STATE]
proof (prove)
using this:
\<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', Q'[x::=u]) \<in> Rel
a\<guillemotleft>x\<guillemotright> \<prec> Q' = b<y> \<prec> Q''

goal (1 subgoal):
 1. \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
proof(cases "x=y", auto simp add: residual.inject name_abs_eq)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>x \<noteq> y; \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel; a = InputS b; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
assume Der: "\<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel"
[PROOF STATE]
proof (state)
this:
\<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel

goal (1 subgoal):
 1. \<lbrakk>x \<noteq> y; \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel; a = InputS b; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
assume xFreshQ'': "x \<sharp> Q''"
[PROOF STATE]
proof (state)
this:
x \<sharp> Q''

goal (1 subgoal):
 1. \<lbrakk>x \<noteq> y; \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel; a = InputS b; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
from Der
[PROOF STATE]
proof (chain)
picking this:
\<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel
[PROOF STEP]
obtain P' where PTrans: "P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P'"
                          and P'RelQ': "(P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel"
[PROOF STATE]
proof (prove)
using this:
\<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel

goal (1 subgoal):
 1. (\<And>P'. \<lbrakk>P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P'; (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P'
(P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel

goal (1 subgoal):
 1. \<lbrakk>x \<noteq> y; \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel; a = InputS b; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
from PTrans yFreshP
[PROOF STATE]
proof (chain)
picking this:
P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P'
y \<sharp> P
[PROOF STEP]
have "P \<Longrightarrow>\<^sub>lu in ([(x, y)] \<bullet> P'')\<rightarrow>b<y> \<prec> P'"
[PROOF STATE]
proof (prove)
using this:
P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P'
y \<sharp> P

goal (1 subgoal):
 1. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P'
[PROOF STEP]
by(rule alphaInput)
[PROOF STATE]
proof (state)
this:
P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P'

goal (1 subgoal):
 1. \<lbrakk>x \<noteq> y; \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel; a = InputS b; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P'

goal (1 subgoal):
 1. \<lbrakk>x \<noteq> y; \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel; a = InputS b; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
from xFreshQ'' P'RelQ'
[PROOF STATE]
proof (chain)
picking this:
x \<sharp> Q''
(P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel
[PROOF STEP]
have "(P', Q''[y::=u]) \<in> Rel"
[PROOF STATE]
proof (prove)
using this:
x \<sharp> Q''
(P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel

goal (1 subgoal):
 1. (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
by(simp add: renaming)
[PROOF STATE]
proof (state)
this:
(P', Q''[y::=u]) \<in> Rel

goal (1 subgoal):
 1. \<lbrakk>x \<noteq> y; \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<x> \<prec> P' \<and> (P', ([(x, y)] \<bullet> Q'')[x::=u]) \<in> Rel; a = InputS b; Q' = [(x, y)] \<bullet> Q''; x \<sharp> Q''\<rbrakk> \<Longrightarrow> \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P'
(P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P'
(P', Q''[y::=u]) \<in> Rel

goal (1 subgoal):
 1. \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
\<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel

goal (1 subgoal):
 1. \<And>Q'a aa xa. \<lbrakk>a\<guillemotleft>x\<guillemotright> \<prec> Q' = aa<xa> \<prec> Q'a; xa \<sharp> P\<rbrakk> \<Longrightarrow> \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>aa<xa> \<prec> P' \<and> (P', Q'a[xa::=u]) \<in> Rel
[PROOF STEP]
thus  "\<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel"
[PROOF STATE]
proof (prove)
using this:
\<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in [(x, y)] \<bullet> P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel

goal (1 subgoal):
 1. \<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>P''. \<forall>u. \<exists>P'. P \<Longrightarrow>\<^sub>lu in P''\<rightarrow>b<y> \<prec> P' \<and> (P', Q''[y::=u]) \<in> Rel

goal:
No subgoals!
[PROOF STEP]
qed