theory F_Spark_Obligation
imports F_Spark_User

begin

lemma goal2'1:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H2: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H4: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H6: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H7: " (16 :: int) <= F_Spark_Declaration.j'' "
  assumes H8: " F_Spark_Declaration.j'' <= (31 :: int) "
  assumes H9:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H10: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H11:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H12:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H13:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H14:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " (0 :: int)
          <= F_Spark_Specification.bit__or'
               ( F_Spark_Specification.bit__and' F_Spark_Declaration.x'' F_Spark_Declaration.y'' )
               ( F_Spark_Specification.bit__and'
                   ( (4294967295 :: int) - F_Spark_Declaration.x'' )
                   F_Spark_Declaration.z''
               )
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal2'2:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H2: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H4: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H6: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H7: " (16 :: int) <= F_Spark_Declaration.j'' "
  assumes H8: " F_Spark_Declaration.j'' <= (31 :: int) "
  assumes H9:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H10: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H11:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H12:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H13:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H14:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " F_Spark_Specification.bit__or'
            ( F_Spark_Specification.bit__and' F_Spark_Declaration.x'' F_Spark_Declaration.y'' )
            ( F_Spark_Specification.bit__and'
                ( (4294967295 :: int) - F_Spark_Declaration.x'' )
                F_Spark_Declaration.z''
            )
          <= (4294967295 :: int)
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal3'1:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H2: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H4: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H6: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H7: " (32 :: int) <= F_Spark_Declaration.j'' "
  assumes H8: " F_Spark_Declaration.j'' <= (47 :: int) "
  assumes H9:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H10: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H11:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H12:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H13:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H14:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " (0 :: int)
          <= F_Spark_Specification.bit__xor'
               ( F_Spark_Specification.bit__or'
                   F_Spark_Declaration.x''
                   ( (4294967295 :: int) - F_Spark_Declaration.y'' )
               )
               F_Spark_Declaration.z''
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal3'2:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H2: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H4: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H6: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H7: " (32 :: int) <= F_Spark_Declaration.j'' "
  assumes H8: " F_Spark_Declaration.j'' <= (47 :: int) "
  assumes H9:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H10: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H11:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H12:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H13:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H14:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " F_Spark_Specification.bit__xor'
            ( F_Spark_Specification.bit__or'
                F_Spark_Declaration.x''
                ( (4294967295 :: int) - F_Spark_Declaration.y'' )
            )
            F_Spark_Declaration.z''
          <= (4294967295 :: int)
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal4'1:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H2: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H4: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H6: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H7: " (48 :: int) <= F_Spark_Declaration.j'' "
  assumes H8: " F_Spark_Declaration.j'' <= (63 :: int) "
  assumes H9:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H10: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H11:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H12:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H13:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H14:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " (0 :: int)
          <= F_Spark_Specification.bit__or'
               ( F_Spark_Specification.bit__and' F_Spark_Declaration.x'' F_Spark_Declaration.z'' )
               ( F_Spark_Specification.bit__and'
                   F_Spark_Declaration.y''
                   ( (4294967295 :: int) - F_Spark_Declaration.z'' )
               )
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal4'2:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H2: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H4: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H6: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H7: " (48 :: int) <= F_Spark_Declaration.j'' "
  assumes H8: " F_Spark_Declaration.j'' <= (63 :: int) "
  assumes H9:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H10: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H11:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H12:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H13:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H14:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " F_Spark_Specification.bit__or'
            ( F_Spark_Specification.bit__and' F_Spark_Declaration.x'' F_Spark_Declaration.z'' )
            ( F_Spark_Specification.bit__and'
                F_Spark_Declaration.y''
                ( (4294967295 :: int) - F_Spark_Declaration.z'' )
            )
          <= (4294967295 :: int)
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal5'1:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.j'' "
  assumes H2: " F_Spark_Declaration.j'' <= (79 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H4: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H6: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H7: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H8: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H9: " (15 :: int) < F_Spark_Declaration.j'' "
  assumes H10: " (31 :: int) < F_Spark_Declaration.j'' "
  assumes H11: " (47 :: int) < F_Spark_Declaration.j'' "
  assumes H12: " (63 :: int) < F_Spark_Declaration.j'' "
  assumes H13:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H14: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H15:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H17:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H18:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " (0 :: int)
          <= F_Spark_Specification.bit__xor'
               F_Spark_Declaration.x''
               ( F_Spark_Specification.bit__or'
                   F_Spark_Declaration.y''
                   ( (4294967295 :: int) - F_Spark_Declaration.z'' )
               )
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal5'2:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.j'' "
  assumes H2: " F_Spark_Declaration.j'' <= (79 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H4: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H6: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H7: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H8: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H9: " (15 :: int) < F_Spark_Declaration.j'' "
  assumes H10: " (31 :: int) < F_Spark_Declaration.j'' "
  assumes H11: " (47 :: int) < F_Spark_Declaration.j'' "
  assumes H12: " (63 :: int) < F_Spark_Declaration.j'' "
  assumes H13:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H14: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H15:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H17:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H18:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " F_Spark_Specification.bit__xor'
            F_Spark_Declaration.x''
            ( F_Spark_Specification.bit__or'
                F_Spark_Declaration.y''
                ( (4294967295 :: int) - F_Spark_Declaration.z'' )
            )
          <= (4294967295 :: int)
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal6'1:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.j'' "
  assumes H2: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H3: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H4: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H5: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H6: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H7: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H8: " F_Spark_Declaration.j'' <= (15 :: int) "
  assumes H9:
  " (0 :: int)
    <= F_Spark_Specification.bit__xor'
         F_Spark_Declaration.x''
         ( F_Spark_Specification.bit__xor' F_Spark_Declaration.y'' F_Spark_Declaration.z'' )
  "
  assumes H10:
  " F_Spark_Specification.bit__xor'
      F_Spark_Declaration.x''
      ( F_Spark_Specification.bit__xor' F_Spark_Declaration.y'' F_Spark_Declaration.z'' )
    <= (4294967295 :: int)
  "
  assumes H11:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H12: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H14:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H15:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H16:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " F_Spark_Specification.bit__xor'
            F_Spark_Declaration.x''
            ( F_Spark_Specification.bit__xor' F_Spark_Declaration.y'' F_Spark_Declaration.z'' )
          = F_Spark_Specification.f'
              F_Spark_Declaration.j''
              F_Spark_Declaration.x''
              F_Spark_Declaration.y''
              F_Spark_Declaration.z''
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal7'1:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H2: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H4: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H6: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H7: " (16 :: int) <= F_Spark_Declaration.j'' "
  assumes H8: " F_Spark_Declaration.j'' <= (31 :: int) "
  assumes H9:
  " (0 :: int)
    <= F_Spark_Specification.bit__or'
         ( F_Spark_Specification.bit__and' F_Spark_Declaration.x'' F_Spark_Declaration.y'' )
         ( F_Spark_Specification.bit__and'
             ( (4294967295 :: int) - F_Spark_Declaration.x'' )
             F_Spark_Declaration.z''
         )
  "
  assumes H10:
  " F_Spark_Specification.bit__or'
      ( F_Spark_Specification.bit__and' F_Spark_Declaration.x'' F_Spark_Declaration.y'' )
      ( F_Spark_Specification.bit__and'
          ( (4294967295 :: int) - F_Spark_Declaration.x'' )
          F_Spark_Declaration.z''
      )
    <= (4294967295 :: int)
  "
  assumes H11:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H12: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H14:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H15:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H16:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " F_Spark_Specification.bit__or'
            ( F_Spark_Specification.bit__and' F_Spark_Declaration.x'' F_Spark_Declaration.y'' )
            ( F_Spark_Specification.bit__and'
                ( (4294967295 :: int) - F_Spark_Declaration.x'' )
                F_Spark_Declaration.z''
            )
          = F_Spark_Specification.f'
              F_Spark_Declaration.j''
              F_Spark_Declaration.x''
              F_Spark_Declaration.y''
              F_Spark_Declaration.z''
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal8'1:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H2: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H4: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H6: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H7: " (32 :: int) <= F_Spark_Declaration.j'' "
  assumes H8: " F_Spark_Declaration.j'' <= (47 :: int) "
  assumes H9:
  " (0 :: int)
    <= F_Spark_Specification.bit__xor'
         ( F_Spark_Specification.bit__or'
             F_Spark_Declaration.x''
             ( (4294967295 :: int) - F_Spark_Declaration.y'' )
         )
         F_Spark_Declaration.z''
  "
  assumes H10:
  " F_Spark_Specification.bit__xor'
      ( F_Spark_Specification.bit__or'
          F_Spark_Declaration.x''
          ( (4294967295 :: int) - F_Spark_Declaration.y'' )
      )
      F_Spark_Declaration.z''
    <= (4294967295 :: int)
  "
  assumes H11:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H12: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H14:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H15:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H16:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " F_Spark_Specification.bit__xor'
            ( F_Spark_Specification.bit__or'
                F_Spark_Declaration.x''
                ( (4294967295 :: int) - F_Spark_Declaration.y'' )
            )
            F_Spark_Declaration.z''
          = F_Spark_Specification.f'
              F_Spark_Declaration.j''
              F_Spark_Declaration.x''
              F_Spark_Declaration.y''
              F_Spark_Declaration.z''
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal9'1:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H2: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H4: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H6: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H7: " (48 :: int) <= F_Spark_Declaration.j'' "
  assumes H8: " F_Spark_Declaration.j'' <= (63 :: int) "
  assumes H9:
  " (0 :: int)
    <= F_Spark_Specification.bit__or'
         ( F_Spark_Specification.bit__and' F_Spark_Declaration.x'' F_Spark_Declaration.z'' )
         ( F_Spark_Specification.bit__and'
             F_Spark_Declaration.y''
             ( (4294967295 :: int) - F_Spark_Declaration.z'' )
         )
  "
  assumes H10:
  " F_Spark_Specification.bit__or'
      ( F_Spark_Specification.bit__and' F_Spark_Declaration.x'' F_Spark_Declaration.z'' )
      ( F_Spark_Specification.bit__and'
          F_Spark_Declaration.y''
          ( (4294967295 :: int) - F_Spark_Declaration.z'' )
      )
    <= (4294967295 :: int)
  "
  assumes H11:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H12: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H14:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H15:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H16:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " F_Spark_Specification.bit__or'
            ( F_Spark_Specification.bit__and' F_Spark_Declaration.x'' F_Spark_Declaration.z'' )
            ( F_Spark_Specification.bit__and'
                F_Spark_Declaration.y''
                ( (4294967295 :: int) - F_Spark_Declaration.z'' )
            )
          = F_Spark_Specification.f'
              F_Spark_Declaration.j''
              F_Spark_Declaration.x''
              F_Spark_Declaration.y''
              F_Spark_Declaration.z''
        " (is "?C1")
apply (insert assms) by (rule userlemmas)

lemma goal10'1:
  assumes R1:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes R2:
  " F_Spark_Declaration.interfaces__unsigned_32__first'' = (0 :: int)
  "
  assumes R3:
  " F_Spark_Declaration.interfaces__unsigned_32__last''
    = (4294967295 :: int)
  "
  assumes R4:
  " F_Spark_Declaration.interfaces__unsigned_32__base__first''
    = (0 :: int)
  "
  assumes R5:
  " F_Spark_Declaration.interfaces__unsigned_32__base__last''
    = (4294967295 :: int)
  "
  assumes R6:
  " F_Spark_Declaration.interfaces__unsigned_32__modulus''
    = (4294967296 :: int)
  "
  assumes R7: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes R8: " F_Spark_Declaration.word__first'' = (0 :: int) "
  assumes R9:
  " F_Spark_Declaration.word__last'' = (4294967295 :: int)
  "
  assumes R10:
  " F_Spark_Declaration.word__base__first'' = (0 :: int)
  "
  assumes R11:
  " F_Spark_Declaration.word__base__last'' = (4294967295 :: int)
  "
  assumes R12:
  " F_Spark_Declaration.word__modulus'' = (4294967296 :: int)
  "
  assumes R13:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes R14:
  " F_Spark_Declaration.round_index__first'' = (0 :: int)
  "
  assumes R15:
  " F_Spark_Declaration.round_index__last'' = (79 :: int)
  "
  assumes R16:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes R17:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__first''
  "
  assumes R18:
  " F_Spark_Declaration.round_index__last''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H1: " (0 :: int) <= F_Spark_Declaration.j'' "
  assumes H2: " F_Spark_Declaration.j'' <= (79 :: int) "
  assumes H3: " (0 :: int) <= F_Spark_Declaration.x'' "
  assumes H4: " F_Spark_Declaration.x'' <= (4294967295 :: int) "
  assumes H5: " (0 :: int) <= F_Spark_Declaration.y'' "
  assumes H6: " F_Spark_Declaration.y'' <= (4294967295 :: int) "
  assumes H7: " (0 :: int) <= F_Spark_Declaration.z'' "
  assumes H8: " F_Spark_Declaration.z'' <= (4294967295 :: int) "
  assumes H9: " (15 :: int) < F_Spark_Declaration.j'' "
  assumes H10: " (31 :: int) < F_Spark_Declaration.j'' "
  assumes H11: " (47 :: int) < F_Spark_Declaration.j'' "
  assumes H12: " (63 :: int) < F_Spark_Declaration.j'' "
  assumes H13:
  " (0 :: int)
    <= F_Spark_Specification.bit__xor'
         F_Spark_Declaration.x''
         ( F_Spark_Specification.bit__or'
             F_Spark_Declaration.y''
             ( (4294967295 :: int) - F_Spark_Declaration.z'' )
         )
  "
  assumes H14:
  " F_Spark_Specification.bit__xor'
      F_Spark_Declaration.x''
      ( F_Spark_Specification.bit__or'
          F_Spark_Declaration.y''
          ( (4294967295 :: int) - F_Spark_Declaration.z'' )
      )
    <= (4294967295 :: int)
  "
  assumes H15:
  " (0 :: int) <= F_Spark_Declaration.interfaces__unsigned_32__size''
  "
  assumes H16: " (0 :: int) <= F_Spark_Declaration.word__size'' "
  assumes H17:
  " (0 :: int) <= F_Spark_Declaration.round_index__size''
  "
  assumes H18:
  " F_Spark_Declaration.round_index__base__first''
    <= F_Spark_Declaration.round_index__base__last''
  "
  assumes H19:
  " F_Spark_Declaration.round_index__base__first'' <= (0 :: int)
  "
  assumes H20:
  " (79 :: int) <= F_Spark_Declaration.round_index__base__last''
  "
  shows " F_Spark_Specification.bit__xor'
            F_Spark_Declaration.x''
            ( F_Spark_Specification.bit__or'
                F_Spark_Declaration.y''
                ( (4294967295 :: int) - F_Spark_Declaration.z'' )
            )
          = F_Spark_Specification.f'
              F_Spark_Declaration.j''
              F_Spark_Declaration.x''
              F_Spark_Declaration.y''
              F_Spark_Declaration.z''
        " (is "?C1")
apply (insert assms) by (rule userlemmas)
end


(*  Title:      HOL/Auth/n_german_lemma_inv__16_on_rules.thy
    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
*)

header{*The n_german Protocol Case Study*}

theory n_german_lemma_inv__16_on_rules imports n_german_lemma_on_inv__16
begin
section{*All lemmas on causal relation between inv__16*}
lemma lemma_inv__16_on_rules:
  assumes b1: "r \<in> rules N" and b2: "(\<exists> p__Inv4. p__Inv4\<le>N\<and>f=inv__16  p__Inv4)"
  shows "invHoldForRule s f r (invariants N)"
  proof -
  have c1: "(\<exists> j. j\<le>N\<and>r=n_SendReqS  j)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendReqEI  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendReqES  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvReq N i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInvE  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInvS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInvAck  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvInvAck  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendGntS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendGntE N i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvGntS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvGntE  i)\<or>
    (\<exists> i d. i\<le>N\<and>d\<le>N\<and>r=n_Store  i d)"
  apply (cut_tac b1, auto) done
    moreover {
      assume d1: "(\<exists> j. j\<le>N\<and>r=n_SendReqS  j)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqSVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendReqEI  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqEIVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendReqES  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqESVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvReq N i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvReqVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInvE  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInvEVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInvS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInvSVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInvAck  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInvAckVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvInvAck  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendGntS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendGntSVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendGntE N i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendGntEVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvGntS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvGntSVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvGntE  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvGntEVsinv__16) done
    }

    moreover {
      assume d1: "(\<exists> i d. i\<le>N\<and>d\<le>N\<and>r=n_Store  i d)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_StoreVsinv__16) done
    }

  ultimately show "invHoldForRule s f r (invariants N)"
  by satx
qed

end


(*
 * Copyright 2014, NICTA
 *
 * This software may be distributed and modified according to the terms of
 * the BSD 2-Clause license. Note that NO WARRANTY is provided.
 * See "LICENSE_BSD2.txt" for details.
 *
 * @TAG(NICTA_BSD)
 *)

theory list_reverse
imports "../CTranslation" "$L4V_ARCH/imports/MachineWords"
begin

declare hrs_simps [simp add]
declare exists_left [simp add]
declare sep_conj_ac [simp add]

primrec
  list :: "machine_word list \<Rightarrow> machine_word ptr \<Rightarrow> heap_state \<Rightarrow> bool"
where
  "list [] i = (\<lambda>s. i=NULL \<and> \<box> s)"
| "list (x#xs) i = (\<lambda>s. i=Ptr x \<and> x\<noteq>0 \<and> (\<exists>j. ((i \<mapsto> j) \<and>\<^sup>* list xs (Ptr j)) s))"

lemma list_empty [simp]:
  shows "list xs NULL = (\<lambda>s. xs = [] \<and> \<box> s)"
  by (cases xs) (auto intro: ext dest!: sep_conj_mapD)

declare sep_conj_com [simp del]
declare sep_conj_left_com [simp del]

install_C_file memsafe "list_reverse.c"

thm list_reverse_global_addresses.reverse_body_def

lemma (in list_reverse_global_addresses)
  shows "reverse_spec"
apply (unfold reverse_spec_def)
apply (hoare_rule HoarePartial.ProcNoRec1)
apply (hoare_rule anno = "reverse_invs_body zs" in HoarePartial.annotateI)
 prefer 2
 apply (simp add: whileAnno_def reverse_invs_body_def)
apply(subst reverse_invs_body_def)
apply(unfold sep_app_def)
apply vcg
  apply (fold lift_def)
  apply(force simp: sep_conj_com)
 apply clarsimp
 apply(case_tac xs)
  apply clarsimp
 apply clarsimp
 apply sep_exists_tac
 apply clarsimp
 apply sep_point_tac
 apply rule
  apply(erule sep_map'_g)
 apply rule
  apply(erule sep_map'_ptr_safe)
 apply(rule_tac x="lista" in exI)
 apply (simp add: ucast_id)
 apply sep_exists_tac
 apply(rule_tac x=j in exI)
 apply simp
 apply(rule sep_heap_update_global)
 apply(erule sep_conj_impl)
  apply simp
 apply(sep_select_tac "list lista _")
 apply(erule sep_conj_impl)
  apply(subgoal_tac "lift a (Ptr aa) = ja")
   apply simp
  apply(erule_tac d=b in sep_map'_lift)
 apply simp
apply(simp add: sep_conj_com)
done

declare hrs_simps [simp del]

lemma (in list_reverse_global_addresses) mem_safe_reverse_invs_body:
  "mem_safe (reverse_invs_body \<alpha>) \<Gamma>"
apply(unfold reverse_invs_body_def creturn_def)
apply(subst mem_safe_restrict)
apply(rule intra_mem_safe)
apply(auto simp: whileAnno_def intra_sc)
done

declare hrs_simps [simp add]

lemma (in list_reverse_global_addresses) sep_frame_reverse_invs_body:
  "\<lbrakk> \<forall>\<sigma>. \<Gamma> \<turnstile> \<lbrace>\<sigma>. (P (f \<acute>(\<lambda>x. x)))\<^bsup>sep\<^esup> \<rbrace> reverse_invs_body \<alpha> \<lbrace> (Q (g \<sigma> \<acute>(\<lambda>x. x)))\<^bsup>sep\<^esup> \<rbrace>;
      htd_ind f; htd_ind g; \<forall>s. htd_ind (g s) \<rbrakk> \<Longrightarrow>
      \<forall>\<sigma>. \<Gamma> \<turnstile> \<lbrace>\<sigma>. (P (f \<acute>(\<lambda>x. x)) \<and>\<^sup>* R (h \<acute>(\<lambda>x. x)))\<^bsup>sep\<^esup> \<rbrace> reverse_invs_body \<alpha>
              \<lbrace> (Q (g \<sigma> \<acute>(\<lambda>x. x)) \<and>\<^sup>* R (h \<sigma>))\<^bsup>sep\<^esup> \<rbrace>"
apply(simp only: sep_app_def)
apply(rule sep_frame)
    apply simp+
apply(rule mem_safe_reverse_invs_body)
done

end


(*
    File:        AllLambda.thy
    Time-stamp:  <2016-01-06T17:58:00Z>
    Author:      JRF
    Web:         http://jrf.cocolog-nifty.com/software/2016/01/post.html
    Logic Image: ZF (of Isabelle2015)
*)

theory AllLambda
imports dB dBeta SndLAlpha SndLBeta Length FNumber FinBndEx
begin

lemma LAlpha3_iff_LAlpha2:
  assumes infv: "Infinite(LVariable)"
  shows "LAlpha3(M, N) <-> <M, N>: LAlpha2"
apply (rule iff_trans [OF LAlpha3_iff_LAlpha
        infv [THEN LAlpha2_iff_LAlpha, THEN iff_sym]])
done

end


(*  Title:       CoreC++
    Author:      Daniel Wasserrab
    Maintainer:  Daniel Wasserrab <wasserra at fmi.uni-passau.de>

    Based on the Jinja theory Common/Conform.thy by David von Oheimb and Tobias Nipkow
*)

section \<open>Conformance Relations for Proofs\<close>

theory Conform
imports Exceptions WellTypeRT
begin

primrec conf :: "prog \<Rightarrow> heap \<Rightarrow> val \<Rightarrow> ty \<Rightarrow> bool"   ("_,_ \<turnstile> _ :\<le> _"  [51,51,51,51] 50) where
  "P,h \<turnstile> v :\<le> Void      = (P \<turnstile> typeof\<^bsub>h\<^esub> v = Some Void)"
| "P,h \<turnstile> v :\<le> Boolean   = (P \<turnstile> typeof\<^bsub>h\<^esub> v = Some Boolean)"
| "P,h \<turnstile> v :\<le> Integer   = (P \<turnstile> typeof\<^bsub>h\<^esub> v = Some Integer)"
| "P,h \<turnstile> v :\<le> NT        = (P \<turnstile> typeof\<^bsub>h\<^esub> v = Some NT)"
| "P,h \<turnstile> v :\<le> (Class C) = (P \<turnstile> typeof\<^bsub>h\<^esub> v = Some(Class C) \<or> P \<turnstile> typeof\<^bsub>h\<^esub> v = Some NT)"

definition fconf :: "prog \<Rightarrow> heap \<Rightarrow> ('a \<rightharpoonup> val) \<Rightarrow> ('a \<rightharpoonup> ty) \<Rightarrow> bool" ("_,_ \<turnstile> _ '(:\<le>') _" [51,51,51,51] 50) where
  "P,h \<turnstile> v\<^sub>m (:\<le>) T\<^sub>m  \<equiv>
  \<forall>FD T. T\<^sub>m FD = Some T \<longrightarrow> (\<exists>v. v\<^sub>m FD = Some v \<and> P,h \<turnstile> v :\<le> T)"

definition oconf :: "prog \<Rightarrow> heap \<Rightarrow> obj \<Rightarrow> bool"   ("_,_ \<turnstile> _ \<surd>" [51,51,51] 50) where
  "P,h \<turnstile> obj \<surd>  \<equiv> let (C,S) = obj in
      (\<forall>Cs. Subobjs P C Cs \<longrightarrow> (\<exists>!fs'. (Cs,fs') \<in> S)) \<and>
      (\<forall>Cs fs'. (Cs,fs') \<in> S \<longrightarrow> Subobjs P C Cs \<and>
                    (\<exists>fs Bs ms. class P (last Cs) = Some (Bs,fs,ms) \<and>
                                P,h \<turnstile> fs' (:\<le>) map_of fs))"

definition hconf :: "prog \<Rightarrow> heap \<Rightarrow> bool"  ("_ \<turnstile> _ \<surd>" [51,51] 50) where
  "P \<turnstile> h \<surd>  \<equiv>
  (\<forall>a obj. h a = Some obj \<longrightarrow> P,h \<turnstile> obj \<surd>) \<and> preallocated h"

definition lconf :: "prog \<Rightarrow> heap \<Rightarrow> ('a \<rightharpoonup> val) \<Rightarrow> ('a \<rightharpoonup> ty) \<Rightarrow> bool"   ("_,_ \<turnstile> _ '(:\<le>')\<^sub>w _" [51,51,51,51] 50) where
  "P,h \<turnstile> v\<^sub>m (:\<le>)\<^sub>w T\<^sub>m  \<equiv>
  \<forall>V v. v\<^sub>m V = Some v \<longrightarrow> (\<exists>T. T\<^sub>m V = Some T \<and> P,h \<turnstile> v :\<le> T)"

abbreviation
  confs :: "prog \<Rightarrow> heap \<Rightarrow> val list \<Rightarrow> ty list \<Rightarrow> bool"
           ("_,_ \<turnstile> _ [:\<le>] _" [51,51,51,51] 50) where
  "P,h \<turnstile> vs [:\<le>] Ts \<equiv> list_all2 (conf P h) vs Ts"

subsection\<open>Value conformance \<open>:\<le>\<close>\<close>

lemma conf_Null [simp]: "P,h \<turnstile> Null :\<le> T  =  P \<turnstile> NT \<le> T"
by(cases T) simp_all

lemma typeof_conf[simp]: "P \<turnstile> typeof\<^bsub>h\<^esub> v = Some T \<Longrightarrow> P,h \<turnstile> v :\<le> T"
by (cases T) auto

lemma typeof_lit_conf[simp]: "typeof v = Some T \<Longrightarrow> P,h \<turnstile> v :\<le> T"
by (rule typeof_conf[OF type_eq_type])

lemma defval_conf[simp]: "is_type P T \<Longrightarrow> P,h \<turnstile> default_val T :\<le> T"
by(cases T) auto

lemma typeof_notclass_heap:
  "\<forall>C. T \<noteq> Class C \<Longrightarrow> (P \<turnstile> typeof\<^bsub>h\<^esub> v = Some T) = (P \<turnstile> typeof\<^bsub>h'\<^esub> v = Some T)"
by(cases T)(auto dest:typeof_Void typeof_NT typeof_Boolean typeof_Integer)

lemma assumes h:"h a = Some(C,S)"
  shows conf_upd_obj: "(P,h(a\<mapsto>(C,S')) \<turnstile> v :\<le> T) = (P,h \<turnstile> v :\<le> T)"

proof(cases T)
  case Void
  hence "(P \<turnstile> typeof\<^bsub>h(a\<mapsto>(C,S'))\<^esub> v = Some T) = (P \<turnstile> typeof\<^bsub>h\<^esub> v = Some T)"
    by(fastforce intro!:typeof_notclass_heap)
  with Void show ?thesis by simp
next
  case Boolean
  hence "(P \<turnstile> typeof\<^bsub>h(a\<mapsto>(C,S'))\<^esub> v = Some T) = (P \<turnstile> typeof\<^bsub>h\<^esub> v = Some T)"
    by(fastforce intro!:typeof_notclass_heap)
  with Boolean show ?thesis by simp
next
  case Integer
  hence "(P \<turnstile> typeof\<^bsub>h(a\<mapsto>(C,S'))\<^esub> v = Some T) = (P \<turnstile> typeof\<^bsub>h\<^esub> v = Some T)"
    by(fastforce intro!:typeof_notclass_heap)
  with Integer show ?thesis by simp
next
  case NT
  hence "(P \<turnstile> typeof\<^bsub>h(a\<mapsto>(C,S'))\<^esub> v = Some T) = (P \<turnstile> typeof\<^bsub>h\<^esub> v = Some T)"
    by(fastforce intro!:typeof_notclass_heap)
  with NT show ?thesis by simp
next
  case (Class C')
  { assume "P \<turnstile> typeof\<^bsub>h(a \<mapsto> (C, S'))\<^esub> v = Some(Class C')"
    with h have "P \<turnstile> typeof\<^bsub>h\<^esub> v = Some(Class C')"
      by (cases v) (auto split:if_split_asm)  }
  hence 1:"P \<turnstile> typeof\<^bsub>h(a \<mapsto> (C, S'))\<^esub> v = Some(Class C') \<Longrightarrow>
           P \<turnstile> typeof\<^bsub>h\<^esub> v = Some(Class C')" by simp
  { assume type:"P \<turnstile> typeof\<^bsub>h(a \<mapsto> (C, S'))\<^esub> v = Some NT"
    and typenot:"P \<turnstile> typeof\<^bsub>h\<^esub> v \<noteq> Some NT"
    have "\<forall>C. NT \<noteq> Class C" by simp
    with type have "P \<turnstile> typeof\<^bsub>h\<^esub> v = Some NT" by(fastforce dest:typeof_notclass_heap)
    with typenot have "P \<turnstile> typeof\<^bsub>h\<^esub> v = Some(Class C')" by simp }
  hence 2:"\<lbrakk>P \<turnstile> typeof\<^bsub>h(a \<mapsto> (C, S'))\<^esub> v = Some NT; P \<turnstile> typeof\<^bsub>h\<^esub> v \<noteq> Some NT\<rbrakk> \<Longrightarrow>
    P \<turnstile> typeof\<^bsub>h\<^esub> v = Some(Class C')" by simp
  { assume "P \<turnstile> typeof\<^bsub>h\<^esub> v = Some(Class C')"
    with h have "P \<turnstile> typeof\<^bsub>h(a \<mapsto> (C, S'))\<^esub> v = Some(Class C')"
      by (cases v) (auto split:if_split_asm) }
  hence 3:"P \<turnstile> typeof\<^bsub>h\<^esub> v = Some(Class C') \<Longrightarrow>
           P \<turnstile> typeof\<^bsub>h(a \<mapsto> (C, S'))\<^esub> v = Some(Class C')" by simp
  { assume typenot:"P \<turnstile> typeof\<^bsub>h(a \<mapsto> (C, S'))\<^esub> v \<noteq> Some NT"
    and type:"P \<turnstile> typeof\<^bsub>h\<^esub> v = Some NT"
    have "\<forall>C. NT \<noteq> Class C" by simp
    with type have "P \<turnstile> typeof\<^bsub>h(a \<mapsto> (C, S'))\<^esub> v = Some NT"
      by(fastforce dest:typeof_notclass_heap)
    with typenot have "P \<turnstile> typeof\<^bsub>h(a \<mapsto> (C, S'))\<^esub> v = Some(Class C')" by simp }
  hence 4:"\<lbrakk>P \<turnstile> typeof\<^bsub>h(a \<mapsto> (C, S'))\<^esub> v \<noteq> Some NT; P \<turnstile> typeof\<^bsub>h\<^esub> v = Some NT\<rbrakk> \<Longrightarrow>
    P \<turnstile> typeof\<^bsub>h(a \<mapsto> (C, S'))\<^esub> v = Some(Class C')" by simp
  from Class show ?thesis by (auto intro:1 2 3 4)
qed

lemma conf_NT [iff]: "P,h \<turnstile> v :\<le> NT = (v = Null)"
by fastforce

subsection\<open>Value list conformance \<open>[:\<le>]\<close>\<close>

lemma confs_rev: "P,h \<turnstile> rev s [:\<le>] t = (P,h \<turnstile> s [:\<le>] rev t)"

  apply rule
  apply (rule subst [OF list_all2_rev])
  apply simp
  apply (rule subst [OF list_all2_rev])
  apply simp
  done

lemma confs_Cons2: "P,h \<turnstile> xs [:\<le>] y#ys = (\<exists>z zs. xs = z#zs \<and> P,h \<turnstile> z :\<le> y \<and> P,h \<turnstile> zs [:\<le>] ys)"
by (rule list_all2_Cons2)

subsection\<open>Field conformance \<open>(:\<le>)\<close>\<close>

lemma fconf_init_fields:
"class P C = Some(Bs,fs,ms) \<Longrightarrow> P,h \<turnstile> init_class_fieldmap P C (:\<le>) map_of fs"

apply(unfold fconf_def init_class_fieldmap_def)
apply clarsimp
apply (rule exI)
apply (rule conjI)
apply (simp add:map_of_map)
apply(case_tac T)
apply simp_all
done

subsection\<open>Heap conformance\<close>

lemma hconfD: "\<lbrakk> P \<turnstile> h \<surd>; h a = Some obj \<rbrakk> \<Longrightarrow> P,h \<turnstile> obj \<surd>"

apply (unfold hconf_def)
apply (fast)
done

lemma hconf_Subobjs:
"\<lbrakk>h a = Some(C,S); (Cs, fs) \<in> S; P \<turnstile> h \<surd>\<rbrakk> \<Longrightarrow> Subobjs P C Cs"

apply (unfold hconf_def)
apply clarsimp
apply (erule_tac x="a" in allE)
apply (erule_tac x="C" in allE)
apply (erule_tac x="S" in allE)
apply clarsimp
apply (unfold oconf_def)
apply fastforce
done

subsection \<open>Local variable conformance\<close>

lemma lconf_upd:
  "\<lbrakk> P,h \<turnstile> l (:\<le>)\<^sub>w E; P,h \<turnstile> v :\<le> T; E V = Some T \<rbrakk> \<Longrightarrow> P,h \<turnstile> l(V\<mapsto>v) (:\<le>)\<^sub>w E"

apply (unfold lconf_def)
apply auto
done

lemma lconf_empty[iff]: "P,h \<turnstile> Map.empty (:\<le>)\<^sub>w E"
by(simp add:lconf_def)

lemma lconf_upd2: "\<lbrakk>P,h \<turnstile> l (:\<le>)\<^sub>w E; P,h \<turnstile> v :\<le> T\<rbrakk> \<Longrightarrow> P,h \<turnstile> l(V\<mapsto>v) (:\<le>)\<^sub>w E(V\<mapsto>T)"
by(simp add:lconf_def)

subsection\<open>Environment conformance\<close>

definition envconf :: "prog \<Rightarrow> env \<Rightarrow> bool" ("_ \<turnstile> _ \<surd>" [51,51] 50) where
  "P \<turnstile> E \<surd> \<equiv> \<forall>V T. E V = Some T \<longrightarrow> is_type P T"

subsection\<open>Type conformance\<close>

primrec
  type_conf :: "prog \<Rightarrow> env \<Rightarrow> heap \<Rightarrow> expr \<Rightarrow> ty \<Rightarrow> bool"
    ("_,_,_ \<turnstile> _ :\<^bsub>NT\<^esub> _" [51,51,51]50)
where
  type_conf_Void:      "P,E,h \<turnstile> e :\<^bsub>NT\<^esub> Void    \<longleftrightarrow> (P,E,h \<turnstile> e : Void)"
  | type_conf_Boolean: "P,E,h \<turnstile> e :\<^bsub>NT\<^esub> Boolean \<longleftrightarrow> (P,E,h \<turnstile> e : Boolean)"
  | type_conf_Integer: "P,E,h \<turnstile> e :\<^bsub>NT\<^esub> Integer \<longleftrightarrow> (P,E,h \<turnstile> e : Integer)"
  | type_conf_NT:      "P,E,h \<turnstile> e :\<^bsub>NT\<^esub> NT      \<longleftrightarrow> (P,E,h \<turnstile> e : NT)"
  | type_conf_Class:   "P,E,h \<turnstile> e :\<^bsub>NT\<^esub> Class C \<longleftrightarrow>
                             (P,E,h \<turnstile> e : Class C \<or> P,E,h \<turnstile> e : NT)"

fun
  types_conf :: "prog \<Rightarrow> env \<Rightarrow> heap \<Rightarrow> expr list \<Rightarrow> ty list \<Rightarrow> bool"
    ("_,_,_ \<turnstile> _ [:]\<^bsub>NT\<^esub> _"   [51,51,51]50)
where
  "P,E,h \<turnstile> [] [:]\<^bsub>NT\<^esub> [] \<longleftrightarrow> True"
  | "P,E,h \<turnstile> (e#es) [:]\<^bsub>NT\<^esub> (T#Ts) \<longleftrightarrow>
      (P,E,h \<turnstile> e:\<^bsub>NT\<^esub> T \<and> P,E,h \<turnstile> es [:]\<^bsub>NT\<^esub> Ts)"
  | "P,E,h \<turnstile> es [:]\<^bsub>NT\<^esub> Ts \<longleftrightarrow> False"

lemma wt_same_type_typeconf:
"P,E,h \<turnstile> e : T \<Longrightarrow> P,E,h \<turnstile> e :\<^bsub>NT\<^esub> T"
by(cases T) auto

lemma wts_same_types_typesconf:
  "P,E,h \<turnstile> es [:] Ts \<Longrightarrow> types_conf P E h es Ts"
proof(induct Ts arbitrary: es)
  case Nil thus ?case by (auto elim:WTrts.cases)
next
  case (Cons T' Ts')
  have wtes:"P,E,h \<turnstile> es [:] T'#Ts'"
    and IH:"\<And>es. P,E,h \<turnstile> es [:] Ts' \<Longrightarrow> types_conf P E h es Ts'" by fact+
  from wtes obtain e' es' where es:"es = e'#es'" by(cases es) auto
  with wtes have wte':"P,E,h \<turnstile> e' : T'" and wtes':"P,E,h \<turnstile> es' [:] Ts'"
    by simp_all
  from IH[OF wtes'] wte' es show ?case by (fastforce intro:wt_same_type_typeconf)
qed

lemma types_conf_smaller_types:
"\<And>es Ts. \<lbrakk>length es = length Ts'; types_conf P E h es Ts'; P \<turnstile> Ts' [\<le>] Ts \<rbrakk>
  \<Longrightarrow> \<exists>Ts''. P,E,h \<turnstile> es [:] Ts'' \<and> P \<turnstile> Ts'' [\<le>] Ts"

proof(induct Ts')
  case Nil thus ?case by simp
next
  case (Cons S Ss)
  have length:"length es = length(S#Ss)"
    and types_conf:"types_conf P E h es (S#Ss)"
    and subs:"P \<turnstile> (S#Ss) [\<le>] Ts"
    and IH:"\<And>es Ts. \<lbrakk>length es = length Ss; types_conf P E h es Ss; P \<turnstile> Ss [\<le>] Ts\<rbrakk>
    \<Longrightarrow> \<exists>Ts''. P,E,h \<turnstile> es [:] Ts'' \<and> P \<turnstile> Ts'' [\<le>] Ts" by fact+
  from subs obtain U Us where Ts:"Ts = U#Us" by(cases Ts) auto
  from length obtain e' es' where es:"es = e'#es'" by(cases es) auto
  with types_conf have type:"P,E,h \<turnstile> e' :\<^bsub>NT\<^esub> S"
    and type':"types_conf P E h es' Ss" by simp_all
  from subs Ts have subs':"P \<turnstile> Ss [\<le>] Us" and sub:"P \<turnstile> S \<le> U"
    by (simp_all add:fun_of_def)
  from sub type obtain T'' where step:"P,E,h \<turnstile> e' : T'' \<and> P \<turnstile> T'' \<le> U"
    by(cases S,auto,cases U,auto)
  from length es have "length es' = length Ss" by simp
  from IH[OF this type' subs'] obtain Ts''
    where "P,E,h \<turnstile> es' [:] Ts'' \<and> P \<turnstile> Ts'' [\<le>] Us"
    by auto
  with step have "P,E,h \<turnstile> (e'#es') [:] (T''#Ts'') \<and> P \<turnstile> (T''#Ts'') [\<le>] (U#Us)"
    by (auto simp:fun_of_def)
  with es Ts show ?case by blast
qed

end