[STATEMENT]
lemma state_separator_from_input_choices_simps :
  assumes "q1 \<in> states M"
      and "q2 \<in> states M"
      and "\<And> qq x . (qq,x) \<in> set cs \<Longrightarrow> qq \<in> states (canonical_separator M q1 q2) \<and> x \<in> inputs M"
      and "Inl (q1,q2) \<in> set (map fst cs)"
      and "\<And> qq . qq \<in> set (map fst cs) \<Longrightarrow> \<exists> q1' q2' . qq = Inl (q1',q2')"
shows
  "initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1,q2)"
  "states (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = (set (map fst cs)) \<union> {Inr q1, Inr q2}"
  "inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = inputs M"
  "outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = outputs M"
  "transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) =
    {t \<in> (transitions (canonical_separator M q1 q2)) . \<exists> q1' q2' x . (Inl (q1',q2'),x) \<in> set cs \<and> t_source t = Inl (q1',q2') \<and> t_input t = x \<and> t_target t \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2}}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (FSM.initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1, q2) &&& FSM.states (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = set (map fst cs) \<union> {Inr q1, Inr q2}) &&& FSM.inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.inputs M &&& FSM.outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.outputs M &&& FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. FSM.initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1, q2)
 2. FSM.states (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = set (map fst cs) \<union> {Inr q1, Inr q2}
 3. FSM.inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.inputs M
 4. FSM.outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.outputs M
 5. FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
let ?SS = "(state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs)"
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. FSM.initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1, q2)
 2. FSM.states (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = set (map fst cs) \<union> {Inr q1, Inr q2}
 3. FSM.inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.inputs M
 4. FSM.outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.outputs M
 5. FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
let ?S0 = "filter_states (canonical_separator M q1 q2) (\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2})"
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. FSM.initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1, q2)
 2. FSM.states (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = set (map fst cs) \<union> {Inr q1, Inr q2}
 3. FSM.inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.inputs M
 4. FSM.outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.outputs M
 5. FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
have "(\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. FSM.initial (canonical_separator M q1 q2) \<in> set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
unfolding canonical_separator_simps[OF assms(1,2)]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Inl (q1, q2) \<in> set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
using assms(4)
[PROOF STATE]
proof (prove)
using this:
Inl (q1, q2) \<in> set (map fst cs)

goal (1 subgoal):
 1. Inl (q1, q2) \<in> set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
FSM.initial (canonical_separator M q1 q2) \<in> set (map fst cs) \<union> {Inr q1, Inr q2}

goal (5 subgoals):
 1. FSM.initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1, q2)
 2. FSM.states (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = set (map fst cs) \<union> {Inr q1, Inr q2}
 3. FSM.inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.inputs M
 4. FSM.outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.outputs M
 5. FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
have "states ?S0 = (set (map fst cs)) \<union> {Inr q1, Inr q2}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) = set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) = set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
have "\<And> qq . qq \<in> states ?S0 \<Longrightarrow> qq \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>qq. qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) \<Longrightarrow> qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
unfolding filter_states_simps[of "(\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2})",
                                   OF \<open>(\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\<close> ]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>qq. qq \<in> Set.filter (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}) (FSM.states (canonical_separator M q1 q2)) \<Longrightarrow> qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
?qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) \<Longrightarrow> ?qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2}

goal (1 subgoal):
 1. FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) = set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
?qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) \<Longrightarrow> ?qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2}

goal (1 subgoal):
 1. FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) = set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
have "\<And> qq . qq \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> states ?S0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>qq. qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qq. qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
fix qq
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>qq. qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
assume "qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2}"
[PROOF STATE]
proof (state)
this:
qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2}

goal (1 subgoal):
 1. \<And>qq. qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
consider (a) "qq \<in> set (map fst cs)" | (b) "qq \<in> {Inr q1, Inr q2}"
[PROOF STATE]
proof (prove)
using this:
qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2}

goal (1 subgoal):
 1. \<lbrakk>qq \<in> set (map fst cs) \<Longrightarrow> thesis; qq \<in> {Inr q1, Inr q2} \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>qq \<in> set (map fst cs) \<Longrightarrow> ?thesis; qq \<in> {Inr q1, Inr q2} \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. \<And>qq. qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>qq \<in> set (map fst cs) \<Longrightarrow> ?thesis; qq \<in> {Inr q1, Inr q2} \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show "qq \<in> states ?S0"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>qq \<in> set (map fst cs) \<Longrightarrow> ?thesis; qq \<in> {Inr q1, Inr q2} \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. qq \<in> set (map fst cs) \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
 2. qq \<in> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
case a
[PROOF STATE]
proof (state)
this:
qq \<in> set (map fst cs)

goal (2 subgoals):
 1. qq \<in> set (map fst cs) \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
 2. qq \<in> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
qq \<in> set (map fst cs)
[PROOF STEP]
obtain q1' q2' where "qq = Inl (q1',q2')"
[PROOF STATE]
proof (prove)
using this:
qq \<in> set (map fst cs)

goal (1 subgoal):
 1. (\<And>q1' q2'. qq = Inl (q1', q2') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms(5)
[PROOF STATE]
proof (prove)
using this:
qq \<in> set (map fst cs)
?qq \<in> set (map fst cs) \<Longrightarrow> \<exists>q1' q2'. ?qq = Inl (q1', q2')

goal (1 subgoal):
 1. (\<And>q1' q2'. qq = Inl (q1', q2') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis old.prod.exhaust)
[PROOF STATE]
proof (state)
this:
qq = Inl (q1', q2')

goal (2 subgoals):
 1. qq \<in> set (map fst cs) \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
 2. qq \<in> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
qq = Inl (q1', q2')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
qq = Inl (q1', q2')

goal (1 subgoal):
 1. qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
using a assms(3)[of qq]
[PROOF STATE]
proof (prove)
using this:
qq = Inl (q1', q2')
qq \<in> set (map fst cs)
(qq, ?x) \<in> set cs \<Longrightarrow> qq \<in> FSM.states (canonical_separator M q1 q2) \<and> ?x \<in> FSM.inputs M

goal (1 subgoal):
 1. qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
unfolding filter_states_simps[of "(\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2})", OF \<open>(\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\<close> ]
                canonical_separator_simps[OF assms(1,2)]
[PROOF STATE]
proof (prove)
using this:
qq = Inl (q1', q2')
qq \<in> set (map fst cs)
(qq, ?x) \<in> set cs \<Longrightarrow> qq \<in> Inl ` FSM.states (Product_FSM.product (from_FSM M q1) (from_FSM M q2)) \<union> {Inr q1, Inr q2} \<and> ?x \<in> FSM.inputs M

goal (1 subgoal):
 1. qq \<in> Set.filter (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}) (Inl ` FSM.states (Product_FSM.product (from_FSM M q1) (from_FSM M q2)) \<union> {Inr q1, Inr q2})
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))

goal (1 subgoal):
 1. qq \<in> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. qq \<in> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
case b
[PROOF STATE]
proof (state)
this:
qq \<in> {Inr q1, Inr q2}

goal (1 subgoal):
 1. qq \<in> {Inr q1, Inr q2} \<Longrightarrow> qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
qq \<in> {Inr q1, Inr q2}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
qq \<in> {Inr q1, Inr q2}

goal (1 subgoal):
 1. qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
using assms(3)
[PROOF STATE]
proof (prove)
using this:
qq \<in> {Inr q1, Inr q2}
(?qq, ?x) \<in> set cs \<Longrightarrow> ?qq \<in> FSM.states (canonical_separator M q1 q2) \<and> ?x \<in> FSM.inputs M

goal (1 subgoal):
 1. qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
unfolding filter_states_simps[of "(\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2})", OF \<open>(\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\<close> ]
                canonical_separator_simps[OF assms(1,2)]
[PROOF STATE]
proof (prove)
using this:
qq \<in> {Inr q1, Inr q2}
(?qq, ?x) \<in> set cs \<Longrightarrow> ?qq \<in> Inl ` FSM.states (Product_FSM.product (from_FSM M q1) (from_FSM M q2)) \<union> {Inr q1, Inr q2} \<and> ?x \<in> FSM.inputs M

goal (1 subgoal):
 1. qq \<in> Set.filter (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}) (Inl ` FSM.states (Product_FSM.product (from_FSM M q1) (from_FSM M q2)) \<union> {Inr q1, Inr q2})
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<Longrightarrow> ?qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))

goal (1 subgoal):
 1. FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) = set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
?qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) \<Longrightarrow> ?qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2}
?qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<Longrightarrow> ?qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
?qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) \<Longrightarrow> ?qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2}
?qq \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<Longrightarrow> ?qq \<in> FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2}))

goal (1 subgoal):
 1. FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) = set (map fst cs) \<union> {Inr q1, Inr q2}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) = set (map fst cs) \<union> {Inr q1, Inr q2}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
FSM.states (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) = set (map fst cs) \<union> {Inr q1, Inr q2}

goal (5 subgoals):
 1. FSM.initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1, q2)
 2. FSM.states (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = set (map fst cs) \<union> {Inr q1, Inr q2}
 3. FSM.inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.inputs M
 4. FSM.outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.outputs M
 5. FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
show "initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1,q2)"
       "states (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = (set (map fst cs)) \<union> {Inr q1, Inr q2}"
       "inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = inputs M"
       "outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = outputs M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (FSM.initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1, q2) &&& FSM.states (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = set (map fst cs) \<union> {Inr q1, Inr q2}) &&& FSM.inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.inputs M &&& FSM.outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.outputs M
[PROOF STEP]
unfolding canonical_separator_simps[OF assms(1,2)]
              filter_transitions_simps
              state_separator_from_input_choices_def
              Let_def
              filter_states_simps(1,3,4,5)[of "(\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2})", OF \<open>(\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\<close> ]
              \<open>states ?S0 = (set (map fst cs)) \<union> {Inr q1, Inr q2}\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (Inl (q1, q2) = Inl (q1, q2) &&& set (map fst cs) \<union> {Inr q1, Inr q2} = set (map fst cs) \<union> {Inr q1, Inr q2}) &&& FSM.inputs M = FSM.inputs M &&& FSM.outputs M = FSM.outputs M
[PROOF STEP]
by simp+
[PROOF STATE]
proof (state)
this:
FSM.initial (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = Inl (q1, q2)
FSM.states (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = set (map fst cs) \<union> {Inr q1, Inr q2}
FSM.inputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.inputs M
FSM.outputs (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = FSM.outputs M

goal (1 subgoal):
 1. FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
have alt_def_shared: "{t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs}
                        = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists> q1' q2' x . (Inl (q1', q2'), x)\<in>set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}"
      (is "?ts1 = ?ts2")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
have "\<And> t . t \<in> ?ts1 \<Longrightarrow> t \<in> ?ts2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t. t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
fix t
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t. t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
assume "t \<in> ?ts1"
[PROOF STATE]
proof (state)
this:
t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs}

goal (1 subgoal):
 1. \<And>t. t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs}
[PROOF STEP]
have "t \<in> FSM.transitions (canonical_separator M q1 q2)" and "t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}" and "t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}" and "(t_source t, t_input t) \<in> set cs"
[PROOF STATE]
proof (prove)
using this:
t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs}

goal (1 subgoal):
 1. (t \<in> FSM.transitions (canonical_separator M q1 q2) &&& t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}) &&& t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} &&& (t_source t, t_input t) \<in> set cs
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
t \<in> FSM.transitions (canonical_separator M q1 q2)
t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}
t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}
(t_source t, t_input t) \<in> set cs

goal (1 subgoal):
 1. \<And>t. t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
have "t_source t \<in> set (map fst cs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t_source t \<in> set (map fst cs)
[PROOF STEP]
using \<open>t \<in> FSM.transitions (canonical_separator M q1 q2)\<close> \<open>t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}\<close>
[PROOF STATE]
proof (prove)
using this:
t \<in> FSM.transitions (canonical_separator M q1 q2)
t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}

goal (1 subgoal):
 1. t_source t \<in> set (map fst cs)
[PROOF STEP]
using canonical_separator_deadlocks[OF assms(1,2)]
[PROOF STATE]
proof (prove)
using this:
t \<in> FSM.transitions (canonical_separator M q1 q2)
t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}
deadlock_state (canonical_separator M q1 q2) (Inr q1)
deadlock_state (canonical_separator M q1 q2) (Inr q2)

goal (1 subgoal):
 1. t_source t \<in> set (map fst cs)
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
t_source t \<in> set (map fst cs)

goal (1 subgoal):
 1. \<And>t. t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t_source t \<in> set (map fst cs)
[PROOF STEP]
obtain q1' q2' where "t_source t = Inl (q1',q2')"
[PROOF STATE]
proof (prove)
using this:
t_source t \<in> set (map fst cs)

goal (1 subgoal):
 1. (\<And>q1' q2'. t_source t = Inl (q1', q2') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms(5)
[PROOF STATE]
proof (prove)
using this:
t_source t \<in> set (map fst cs)
?qq \<in> set (map fst cs) \<Longrightarrow> \<exists>q1' q2'. ?qq = Inl (q1', q2')

goal (1 subgoal):
 1. (\<And>q1' q2'. t_source t = Inl (q1', q2') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis old.prod.exhaust)
[PROOF STATE]
proof (state)
this:
t_source t = Inl (q1', q2')

goal (1 subgoal):
 1. \<And>t. t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
t_source t = Inl (q1', q2')
[PROOF STEP]
have "\<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x"
[PROOF STATE]
proof (prove)
using this:
t_source t = Inl (q1', q2')

goal (1 subgoal):
 1. \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x
[PROOF STEP]
using \<open>(t_source t, t_input t) \<in> set cs\<close>
[PROOF STATE]
proof (prove)
using this:
t_source t = Inl (q1', q2')
(t_source t, t_input t) \<in> set cs

goal (1 subgoal):
 1. \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x

goal (1 subgoal):
 1. \<And>t. t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x
[PROOF STEP]
show "t \<in> ?ts2"
[PROOF STATE]
proof (prove)
using this:
\<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x

goal (1 subgoal):
 1. t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
using \<open>t \<in> FSM.transitions (canonical_separator M q1 q2)\<close> \<open>t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}\<close>
[PROOF STATE]
proof (prove)
using this:
\<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x
t \<in> FSM.transitions (canonical_separator M q1 q2)
t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}

goal (1 subgoal):
 1. t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> ?t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}

goal (1 subgoal):
 1. {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
?t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> ?t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}

goal (1 subgoal):
 1. {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
have "\<And> t . t \<in> ?ts2 \<Longrightarrow> t \<in> ?ts1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}} \<Longrightarrow> t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
?t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}} \<Longrightarrow> ?t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs}

goal (1 subgoal):
 1. {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
?t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> ?t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
?t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}} \<Longrightarrow> ?t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
?t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} \<Longrightarrow> ?t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
?t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}} \<Longrightarrow> ?t \<in> {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs}

goal (1 subgoal):
 1. {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
{t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
{t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}

goal (1 subgoal):
 1. FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
show "transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) =
    {t \<in> (transitions (canonical_separator M q1 q2)) . \<exists> q1' q2' x . (Inl (q1',q2'),x) \<in> set cs \<and> t_source t = Inl (q1',q2') \<and> t_input t = x \<and> t_target t \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2}}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
unfolding canonical_separator_simps(1,2,3,4)[OF assms(1,2)]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
unfolding state_separator_from_input_choices_def Let_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. FSM.transitions (FSM.filter_transitions (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})) (\<lambda>t. (t_source t, t_input t) \<in> set cs)) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
unfolding filter_transitions_simps
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {t \<in> FSM.transitions (FSM.filter_states (canonical_separator M q1 q2) (\<lambda>q. q \<in> set (map fst cs) \<union> {Inr q1, Inr q2})). (t_source t, t_input t) \<in> set cs} = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
unfolding filter_states_simps[of "(\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2})", OF \<open>(\<lambda> q . q \<in> (set (map fst cs)) \<union> {Inr q1, Inr q2}) (initial (canonical_separator M q1 q2))\<close> ]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {t \<in> {t \<in> FSM.transitions (canonical_separator M q1 q2). t_source t \<in> set (map fst cs) \<union> {Inr q1, Inr q2} \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}. (t_source t, t_input t) \<in> set cs} = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
unfolding alt_def_shared
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}} = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
FSM.transitions (state_separator_from_input_choices M (canonical_separator M q1 q2) q1 q2 cs) = {t \<in> FSM.transitions (canonical_separator M q1 q2). \<exists>q1' q2' x. (Inl (q1', q2'), x) \<in> set cs \<and> t_source t = Inl (q1', q2') \<and> t_input t = x \<and> t_target t \<in> set (map fst cs) \<union> {Inr q1, Inr q2}}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma list_ex_length_O:
assumes "list_ex \<gamma> tr"  shows "length (O tr) > 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < length (O tr)
[PROOF STEP]
by (metis assms O_Nil_list_ex length_greater_0_conv)