[STATEMENT]
lemma sub_instr_sub1_low_equal:
assumes a1: "low_equal s1 s2 \<and>
t1 = snd (fst (sub_instr_sub1 instr_name result rs1_val operand2 s1)) \<and>
t2 = snd (fst (sub_instr_sub1 instr_name result rs1_val operand2 s2))"
shows "low_equal t1 t2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. low_equal t1 t2
[PROOF STEP]
proof (cases "instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc \<Longrightarrow> low_equal t1 t2
 2. \<not> (instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc) \<Longrightarrow> low_equal t1 t2
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc

goal (2 subgoals):
 1. instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc \<Longrightarrow> low_equal t1 t2
 2. \<not> (instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc) \<Longrightarrow> low_equal t1 t2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc

goal (1 subgoal):
 1. low_equal t1 t2
[PROOF STEP]
using a1
[PROOF STATE]
proof (prove)
using this:
instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc
low_equal s1 s2 \<and> t1 = snd (fst (sub_instr_sub1 instr_name result rs1_val operand2 s1)) \<and> t2 = snd (fst (sub_instr_sub1 instr_name result rs1_val operand2 s2))

goal (1 subgoal):
 1. low_equal t1 t2
[PROOF STEP]
apply (simp add: sub_instr_sub1_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc; low_equal s1 s2 \<and> t1 = snd (fst ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
write_cpu (update_PSR_icc (ucast (result >> 31)) (if result = 0 then 1 else 0) (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) psr_val) PSR
od) s1)) \<and> t2 = snd (fst ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
write_cpu (update_PSR_icc (ucast (result >> 31)) (if result = 0 then 1 else 0) (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) psr_val) PSR
od) s2))\<rbrakk> \<Longrightarrow> (result = 0 \<longrightarrow> low_equal (snd (fst ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
write_cpu (update_PSR_icc 0 1 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31))) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31)) psr_val) PSR
od) s1))) (snd (fst ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
write_cpu (update_PSR_icc 0 1 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31))) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31)) psr_val) PSR
od) s2)))) \<and> (result \<noteq> 0 \<longrightarrow> low_equal (snd (fst ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
write_cpu (update_PSR_icc (ucast (result >> 31)) 0 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) psr_val) PSR
od) s1))) (snd (fst ((do psr_val \<leftarrow> gets (cpu_reg_val PSR);
write_cpu (update_PSR_icc (ucast (result >> 31)) 0 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) psr_val) PSR
od) s2))))
[PROOF STEP]
apply (simp add: simpler_gets_def bind_def h1_def h2_def Let_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc; low_equal s1 s2 \<and> t1 = snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) (if result = 0 then 1 else 0) (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s1)) PSR s1)) \<and> t2 = snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) (if result = 0 then 1 else 0) (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s2)) PSR s2))\<rbrakk> \<Longrightarrow> (result = 0 \<longrightarrow> low_equal (snd (fst (write_cpu (update_PSR_icc 0 1 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31))) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31)) (cpu_reg_val PSR s1)) PSR s1))) (snd (fst (write_cpu (update_PSR_icc 0 1 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31))) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31)) (cpu_reg_val PSR s2)) PSR s2)))) \<and> (result \<noteq> 0 \<longrightarrow> low_equal (snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) 0 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s1)) PSR s1))) (snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) 0 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s2)) PSR s2))))
[PROOF STEP]
apply (clarsimp simp add: cpu_reg_val_low_equal)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc; low_equal s1 s2; t1 = snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) (if result = 0 then 1 else 0) (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s2)) PSR s1)); t2 = snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) (if result = 0 then 1 else 0) (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s2)) PSR s2))\<rbrakk> \<Longrightarrow> (result = 0 \<longrightarrow> low_equal (snd (fst (write_cpu (update_PSR_icc 0 1 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31))) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31)) (cpu_reg_val PSR s2)) PSR s1))) (snd (fst (write_cpu (update_PSR_icc 0 1 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31))) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31)) (cpu_reg_val PSR s2)) PSR s2)))) \<and> (result \<noteq> 0 \<longrightarrow> low_equal (snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) 0 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s2)) PSR s1))) (snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) 0 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s2)) PSR s2))))
[PROOF STEP]
using write_cpu_low_equal
[PROOF STATE]
proof (prove)
using this:
low_equal ?s1.0 ?s2.0 \<and> ?t1.0 = snd (fst (write_cpu ?w ?cr ?s1.0)) \<and> ?t2.0 = snd (fst (write_cpu ?w ?cr ?s2.0)) \<Longrightarrow> low_equal ?t1.0 ?t2.0

goal (1 subgoal):
 1. \<lbrakk>instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc; low_equal s1 s2; t1 = snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) (if result = 0 then 1 else 0) (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s2)) PSR s1)); t2 = snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) (if result = 0 then 1 else 0) (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s2)) PSR s2))\<rbrakk> \<Longrightarrow> (result = 0 \<longrightarrow> low_equal (snd (fst (write_cpu (update_PSR_icc 0 1 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31))) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31)) (cpu_reg_val PSR s2)) PSR s1))) (snd (fst (write_cpu (update_PSR_icc 0 1 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31))) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31)) (cpu_reg_val PSR s2)) PSR s2)))) \<and> (result \<noteq> 0 \<longrightarrow> low_equal (snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) 0 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s2)) PSR s1))) (snd (fst (write_cpu (update_PSR_icc (ucast (result >> 31)) 0 (ucast (rs1_val >> 31) AND NOT (ucast (operand2 >> 31)) AND NOT (ucast (result >> 31)) OR NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) AND ucast (result >> 31)) (NOT (ucast (rs1_val >> 31)) AND ucast (operand2 >> 31) OR ucast (result >> 31) AND (NOT (ucast (rs1_val >> 31)) OR ucast (operand2 >> 31))) (cpu_reg_val PSR s2)) PSR s2))))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
low_equal t1 t2

goal (1 subgoal):
 1. \<not> (instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc) \<Longrightarrow> low_equal t1 t2
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> (instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc) \<Longrightarrow> low_equal t1 t2
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> (instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc)

goal (1 subgoal):
 1. \<not> (instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc) \<Longrightarrow> low_equal t1 t2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> (instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> (instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc)

goal (1 subgoal):
 1. low_equal t1 t2
[PROOF STEP]
using a1
[PROOF STATE]
proof (prove)
using this:
\<not> (instr_name = arith_type SUBcc \<or> instr_name = arith_type SUBXcc)
low_equal s1 s2 \<and> t1 = snd (fst (sub_instr_sub1 instr_name result rs1_val operand2 s1)) \<and> t2 = snd (fst (sub_instr_sub1 instr_name result rs1_val operand2 s2))

goal (1 subgoal):
 1. low_equal t1 t2
[PROOF STEP]
apply (simp add: sub_instr_sub1_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>instr_name \<noteq> arith_type SUBcc \<and> instr_name \<noteq> arith_type SUBXcc; low_equal s1 s2 \<and> t1 = snd (fst (return () s1)) \<and> t2 = snd (fst (return () s2))\<rbrakk> \<Longrightarrow> low_equal (snd (fst (return () s1))) (snd (fst (return () s2)))
[PROOF STEP]
by (simp add: return_def)
[PROOF STATE]
proof (state)
this:
low_equal t1 t2

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
theorem (in cnf) no_type_errors:
  "P \<turnstile> (Normal \<sigma>) -jvmd\<rightarrow> \<sigma>' \<Longrightarrow> \<sigma>' \<noteq> TypeError"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<turnstile> Normal \<sigma> -jvmd\<rightarrow> \<sigma>' \<Longrightarrow> \<sigma>' \<noteq> TypeError
[PROOF STEP]
apply (unfold exec_all_d_def1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (Normal \<sigma>, \<sigma>') \<in> (exec_1_d P)\<^sup>* \<Longrightarrow> \<sigma>' \<noteq> TypeError
[PROOF STEP]
apply (erule rtrancl_induct)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. Normal \<sigma> \<noteq> TypeError
 2. \<And>y z. \<lbrakk>(Normal \<sigma>, y) \<in> (exec_1_d P)\<^sup>*; P \<turnstile> y -jvmd\<rightarrow>\<^sub>1 z; y \<noteq> TypeError\<rbrakk> \<Longrightarrow> z \<noteq> TypeError
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y z. \<lbrakk>(Normal \<sigma>, y) \<in> (exec_1_d P)\<^sup>*; P \<turnstile> y -jvmd\<rightarrow>\<^sub>1 z; y \<noteq> TypeError\<rbrakk> \<Longrightarrow> z \<noteq> TypeError
[PROOF STEP]
apply (fold exec_all_d_def1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y z. \<lbrakk>P \<turnstile> Normal \<sigma> -jvmd\<rightarrow> y; P \<turnstile> y -jvmd\<rightarrow>\<^sub>1 z; y \<noteq> TypeError\<rbrakk> \<Longrightarrow> z \<noteq> TypeError
[PROOF STEP]
apply (insert cnf wf)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y z. \<lbrakk>P \<turnstile> Normal \<sigma> -jvmd\<rightarrow> y; P \<turnstile> y -jvmd\<rightarrow>\<^sub>1 z; y \<noteq> TypeError; P,\<Phi> |- \<sigma> [ok]; wf_jvm_prog\<^bsub>\<Phi>\<^esub> P\<rbrakk> \<Longrightarrow> z \<noteq> TypeError
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>z a aa b. \<lbrakk>P \<turnstile> Normal \<sigma> -jvmd\<rightarrow> Normal (a, aa, b); P \<turnstile> Normal (a, aa, b) -jvmd\<rightarrow>\<^sub>1 z; P,\<Phi> |- \<sigma> [ok]; wf_jvm_prog\<^bsub>\<Phi>\<^esub> P\<rbrakk> \<Longrightarrow> \<exists>a aa b. z = Normal (a, aa, b)
[PROOF STEP]
apply (drule defensive_imp_aggressive)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>z a aa b. \<lbrakk>P \<turnstile> Normal (a, aa, b) -jvmd\<rightarrow>\<^sub>1 z; P,\<Phi> |- \<sigma> [ok]; wf_jvm_prog\<^bsub>\<Phi>\<^esub> P; P \<turnstile> \<sigma> -jvm\<rightarrow> (a, aa, b)\<rbrakk> \<Longrightarrow> \<exists>a aa b. z = Normal (a, aa, b)
[PROOF STEP]
apply (frule (2) BV_correct)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>z a aa b. \<lbrakk>P \<turnstile> Normal (a, aa, b) -jvmd\<rightarrow>\<^sub>1 z; P,\<Phi> |- \<sigma> [ok]; wf_jvm_prog\<^bsub>\<Phi>\<^esub> P; P \<turnstile> \<sigma> -jvm\<rightarrow> (a, aa, b); P,\<Phi> |- (a, aa, b) [ok]\<rbrakk> \<Longrightarrow> \<exists>a aa b. z = Normal (a, aa, b)
[PROOF STEP]
apply (drule (1) no_type_error)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>z a aa b. \<lbrakk>P \<turnstile> Normal (a, aa, b) -jvmd\<rightarrow>\<^sub>1 z; P,\<Phi> |- \<sigma> [ok]; P \<turnstile> \<sigma> -jvm\<rightarrow> (a, aa, b); P,\<Phi> |- (a, aa, b) [ok]; exec_d P \<sigma> \<noteq> TypeError\<rbrakk> \<Longrightarrow> \<exists>a aa b. z = Normal (a, aa, b)
[PROOF STEP]
back
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>z a aa b. \<lbrakk>P \<turnstile> Normal (a, aa, b) -jvmd\<rightarrow>\<^sub>1 z; P,\<Phi> |- \<sigma> [ok]; P \<turnstile> \<sigma> -jvm\<rightarrow> (a, aa, b); P,\<Phi> |- (a, aa, b) [ok]; exec_d P (a, aa, b) \<noteq> TypeError\<rbrakk> \<Longrightarrow> \<exists>a aa b. z = Normal (a, aa, b)
[PROOF STEP]
apply (auto simp add: exec_1_d_eq)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma abstract_for_simple_firewall_negated_ifaces_prots: fixes m :: "'i::len common_primitive match_expr"
  shows  "normalized_nnf_match m \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_for_simple_firewall m)"
  and "normalized_nnf_match m \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_for_simple_firewall m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (normalized_nnf_match m \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_for_simple_firewall m)) &&& (normalized_nnf_match m \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_for_simple_firewall m))
[PROOF STEP]
unfolding abstract_for_simple_firewall_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (normalized_nnf_match m \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_primitive (\<lambda>r. case r of Pos a \<Rightarrow> is_CT_State a \<or> is_L4_Flags a | Neg a \<Rightarrow> is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a) m)) &&& (normalized_nnf_match m \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_primitive (\<lambda>r. case r of Pos a \<Rightarrow> is_CT_State a \<or> is_L4_Flags a | Neg a \<Rightarrow> is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a) m))
[PROOF STEP]
apply(induction "(\<lambda>r:: 'i common_primitive negation_type. case r of Pos a \<Rightarrow> is_CT_State a | Neg a \<Rightarrow> is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a)" m rule: abstract_primitive.induct)
[PROOF STATE]
proof (prove)
goal (14 subgoals):
 1. normalized_nnf_match MatchAny \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) MatchAny)
 2. normalized_nnf_match MatchAny \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) MatchAny)
 3. \<And>a. normalized_nnf_match (Match a) \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (Match a))
 4. \<And>a. normalized_nnf_match (Match a) \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (Match a))
 5. \<And>a. normalized_nnf_match (MatchNot (Match a)) \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchNot (Match a)))
 6. \<And>a. normalized_nnf_match (MatchNot (Match a)) \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchNot (Match a)))
 7. \<And>v. \<lbrakk>normalized_nnf_match (MatchNot v) \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchNot v)); normalized_nnf_match (MatchNot v) \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchNot v)); normalized_nnf_match (MatchNot (MatchNot v))\<rbrakk> \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchNot (MatchNot v)))
 8. \<And>v. \<lbrakk>normalized_nnf_match (MatchNot v) \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchNot v)); normalized_nnf_match (MatchNot v) \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchNot v)); normalized_nnf_match (MatchNot (MatchNot v))\<rbrakk> \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchNot (MatchNot v)))
 9. \<And>v va. \<lbrakk>normalized_nnf_match (MatchAnd v va) \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchAnd v va)); normalized_nnf_match (MatchAnd v va) \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchAnd v va)); normalized_nnf_match (MatchNot (MatchAnd v va))\<rbrakk> \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchNot (MatchAnd v va)))
 10. \<And>v va. \<lbrakk>normalized_nnf_match (MatchAnd v va) \<Longrightarrow> \<not> has_disc_negated (\<lambda>a. is_Iiface a \<or> is_Oiface a) False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchAnd v va)); normalized_nnf_match (MatchAnd v va) \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchAnd v va)); normalized_nnf_match (MatchNot (MatchAnd v va))\<rbrakk> \<Longrightarrow> \<not> has_disc_negated is_Prot False (abstract_primitive (case_negation_type (\<lambda>a. is_CT_State a \<or> is_L4_Flags a) (\<lambda>a. is_Iiface a \<or> is_Oiface a \<or> is_Prot a \<or> is_CT_State a \<or> is_L4_Flags a)) (MatchNot (MatchAnd v va)))
A total of 14 subgoals...
[PROOF STEP]
apply(simp_all)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done