(*  Title:      HOL/Auth/n_german_lemma_invs_on_rules.thy
    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
*)

header{*The n_german Protocol Case Study*}

theory n_german_lemma_invs_on_rules imports n_german_lemma_inv__1_on_rules n_german_lemma_inv__2_on_rules n_german_lemma_inv__3_on_rules n_german_lemma_inv__4_on_rules n_german_lemma_inv__5_on_rules n_german_lemma_inv__6_on_rules n_german_lemma_inv__7_on_rules n_german_lemma_inv__8_on_rules n_german_lemma_inv__9_on_rules n_german_lemma_inv__10_on_rules n_german_lemma_inv__11_on_rules n_german_lemma_inv__12_on_rules n_german_lemma_inv__13_on_rules n_german_lemma_inv__14_on_rules n_german_lemma_inv__15_on_rules n_german_lemma_inv__16_on_rules n_german_lemma_inv__17_on_rules n_german_lemma_inv__18_on_rules n_german_lemma_inv__19_on_rules n_german_lemma_inv__20_on_rules n_german_lemma_inv__21_on_rules n_german_lemma_inv__22_on_rules n_german_lemma_inv__23_on_rules n_german_lemma_inv__24_on_rules n_german_lemma_inv__25_on_rules n_german_lemma_inv__26_on_rules n_german_lemma_inv__27_on_rules n_german_lemma_inv__28_on_rules n_german_lemma_inv__29_on_rules n_german_lemma_inv__30_on_rules n_german_lemma_inv__31_on_rules n_german_lemma_inv__32_on_rules n_german_lemma_inv__33_on_rules n_german_lemma_inv__34_on_rules n_german_lemma_inv__35_on_rules n_german_lemma_inv__36_on_rules n_german_lemma_inv__37_on_rules n_german_lemma_inv__38_on_rules n_german_lemma_inv__39_on_rules n_german_lemma_inv__40_on_rules n_german_lemma_inv__41_on_rules n_german_lemma_inv__42_on_rules n_german_lemma_inv__43_on_rules n_german_lemma_inv__44_on_rules n_german_lemma_inv__45_on_rules n_german_lemma_inv__46_on_rules n_german_lemma_inv__47_on_rules n_german_lemma_inv__48_on_rules n_german_lemma_inv__49_on_rules n_german_lemma_inv__50_on_rules n_german_lemma_inv__51_on_rules
begin
lemma invs_on_rules:
  assumes a1: "f \<in> invariants N" and a2: "r \<in> rules N"
  shows "invHoldForRule s f r (invariants N)"
  proof -
  have b1: "(f=inv__1  )\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__2  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__3  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__4  p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__5  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__6  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__7  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__8  p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__9  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__10  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__11  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__12  p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__13  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__14  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__15  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__16  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__17  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__18  p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__19  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__20  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__21  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__22  p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__23  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__24  p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__25  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__26  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__27  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__28  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__29  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__30  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__31  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__32  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__33  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__34  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__35  p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__36  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__37  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__38  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__39  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__40  p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__41  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__42  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__43  p__Inv2)\<or>
    (\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__44  p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__45  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__46  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__47  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__48  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__49  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__50  p__Inv1 p__Inv2)\<or>
    (\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__51  p__Inv1 p__Inv2)"
  apply (cut_tac a1, auto) done
    moreover {
      assume c1: "(f=inv__1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__1_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__2  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__2_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__3  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__3_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__4  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__4_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__5  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__5_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__6  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__6_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__7  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__7_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__8  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__8_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__9  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__9_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__10  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__10_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__11  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__11_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__12  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__12_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__13  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__13_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__14  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__14_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__15  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__15_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__16  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__16_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__17  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__17_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__18  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__18_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__19  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__19_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__20  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__20_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__21  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__21_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__22  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__22_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__23  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__23_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__24  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__24_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__25  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__25_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__26  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__26_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__27  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__27_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__28  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__28_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__29  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__29_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__30  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__30_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__31  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__31_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__32  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__32_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__33  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__33_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__34  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__34_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__35  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__35_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__36  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__36_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__37  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__37_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__38  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__38_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__39  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__39_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__40  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__40_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__41  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__41_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__42  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__42_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__43  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__43_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__44  p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__44_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__45  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__45_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__46  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__46_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__47  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__47_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__48  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__48_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__49  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__49_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__50  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__50_on_rules) done
    }

    moreover {
      assume c1: "(\<exists> p__Inv1 p__Inv2. p__Inv1\<le>N\<and>p__Inv2\<le>N\<and>p__Inv1~=p__Inv2\<and>f=inv__51  p__Inv1 p__Inv2)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac a2 c1, metis lemma_inv__51_on_rules) done
    }

  ultimately show "invHoldForRule s f r (invariants N)"
  by satx
qed

end


           (*-------------------------------------------*
            |                DFP package                |
            |                   June 2005               |
            |               December 2005  (modified)   |
            |                                           |
            |   DFP on CSP-Prover ver.3.0               |
            |              September 2006  (modified)   |
            |                  April 2007  (modified)   |
            |                                           |
            |        Yoshinao Isobe (AIST JAPAN)        |
            *-------------------------------------------*)

theory DFP_Deadlock
imports DFP_Network
begin

(*  The following simplification rules are deleted in this theory file *)
(*  because they unexpectly rewrite UnionT and InterT.                 *)
(*                  Union (B ` A) = (UN x:A. B x)                      *)
(*                  Inter (B ` A) = (INT x:A. B x)                     *)
(*
declare Union_image_eq [simp del]
declare Inter_image_eq [simp del]
*)
declare Sup_image_eq [simp del]
declare Inf_image_eq [simp del]
(*  The following simplification rules are deleted in this theory file *)
(*  because they unexpectly rewrite (notick | t = []t)                 *)
(*                                                                     *)
(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)

declare disj_not1 [simp del]

(*****************************************************************

         1.
         2.
         3.
         4.

 *****************************************************************)

(*********************************************************
                    definitions
 *********************************************************)

definition
  DeadlockFree :: "'a event set => ('p,'a) proc => bool"
                                           ("(0[_]-DeadlockFree _)" [0,55] 55)
  where
  DeadlockFree_def :
    "[X]-DeadlockFree P == (ALL s. (Tick ~: sett(s)) --> (s,X) ~:f failures P MF)"

  (* R is deadlock free with respect to X, thus
     R can always perform an event in X at least *)

definition
  DeadlockFreeNetwork :: "('i,'p,'a) Network => bool"
  where
  DeadlockFreeNetwork_def :
    "DeadlockFreeNetwork V ==
     [Ev ` (ALP V)]-DeadlockFree PAR V"

(*** UNIV deadlockfree ***)

syntax
  "@isDeadlockFree"  :: "('p,'a) proc => bool"
                         ("_ isDeadlockFree" [1000] 1000)

translations
  "P isDeadlockFree"  == "[(CONST UNIV)]-DeadlockFree P"

definition
  isDeadlockStateOf ::
   "('i,'a) net_state => ('i,'a) NetworkF => bool"
                           ("(0_ isDeadlockStateOf _)" [55,55] 55)
  where
  isDeadlockStateOf_def :
   "sigma isDeadlockStateOf VF ==
                sigma isStateOf VF &
                Union {((snd sigma) i) |i. i : fst VF}
                = Ev ` (ALP VF)"

(*********************************************************
           isDeadlockStateOf subset alpha
 *********************************************************)

lemma isDeadlockStateOf_subset_alpha1:
   "[| (I, FXf) isFailureOf (I, PXf) ;
       (t, Yf) isDeadlockStateOf (I, FXf) ;
       i : I ; e : Yf i|]
    ==> e : (Ev ` (snd (PXf i)))"
apply (simp add: isDeadlockStateOf_def)
apply (auto simp add: isStateOf_subset_alpha)
done

lemma isDeadlockStateOf_subset_alpha2:
   "[| (I, FXf) isFailureOf (I, PXf) ;
       (t, Yf) isDeadlockStateOf (I, FXf) ;
       i : I ; e : Yf i|]
    ==> e : (Ev ` (snd (FXf i)))"
apply (simp add: isDeadlockStateOf_def)
apply (auto simp add: isStateOf_subset_alpha)
done

lemmas isDeadlockStateOf_subset_alpha = isDeadlockStateOf_subset_alpha1
                                        isDeadlockStateOf_subset_alpha2

(*********************************************************
             Deadlock and Deadlock freedom
 *********************************************************)

(*** Existency ***)

lemma DeadlockState_notDeadlockFree_only_if_lmEX_lm:
  "[|  ALL s Y.
                 (s, Y) : fst (FXf i) -->
                 (s, Y) :f failures (fst (PXf i)) MF & Y <= Ev ` snd (FXf i);
        (s rest-tr snd (FXf i), Z) : fst (FXf i);
              Yf i Int Ev ` snd (FXf i) <= Z |]
           ==> (s rest-tr snd (FXf i),
                SOME Z.
                   (s rest-tr snd (FXf i), Z) : fst (FXf i) &
                   Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i))
               : fst (FXf i) &
               Yf i Int Ev ` snd (FXf i)
               <= (SOME Z.
                      (s rest-tr snd (FXf i), Z) : fst (FXf i) &
                      Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i)) &
               (SOME Z.
                   (s rest-tr snd (FXf i), Z) : fst (FXf i) &
                   Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i))
               <= Ev ` snd (FXf i)"
apply (rule someI2[of
"(%Z. (s rest-tr snd (FXf i), Z) : fst (FXf i) &
      Yf i Int Ev ` snd (FXf i) <= Z & Z <= Ev ` snd (FXf i))" Z])
apply (rule conjI)
apply (simp)
apply (simp)
apply (simp)
done

lemma DeadlockState_notDeadlockFree_only_if_lmEX:
   "[| (I, FXf) isFailureOf (I, PXf) ;
       ALL i:I. (s rest-tr (snd (PXf i)), Yf i)
                :f failures (fst (PXf i)) MF |]
    ==>
    EX Zf. ALL i:I. (s rest-tr (snd (FXf i)), Zf i) : fst (FXf i) &
                    Yf i Int Ev ` snd (FXf i) <= Zf i &
                    Zf i <= Ev ` snd (FXf i)"
 apply (rule_tac x=
   "(%i. (SOME Z. (s rest-tr (snd (FXf i)), Z) : fst (FXf i) &
                    Yf i Int Ev ` snd (FXf i) <= Z &
                    Z <= Ev ` snd (FXf i)))" in exI)
apply (intro ballI impI)
apply (simp add: isFailureOf_def)
apply (drule_tac x="i" in bspec, simp)
apply (drule_tac x="i" in bspec, simp)
apply (simp add: subseteqEX_restRefusal_iff)
apply (elim conjE exE)
apply (rotate_tac -2)

apply (drule_tac x="s rest-tr snd (FXf i)" in spec)
apply (drule_tac x="Yf i" in spec)
apply (simp)
apply (elim conjE exE)
apply (rule DeadlockState_notDeadlockFree_only_if_lmEX_lm)
apply (simp_all)
apply (force)
done

(* only if part *)

lemma DeadlockState_notDeadlockFree_only_if:
  "[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) ;
      ~ DeadlockFreeNetwork (I,PXf) |]
   ==> (EX sigma. (sigma isDeadlockStateOf (I,FXf)))"
apply (simp add: DeadlockFreeNetwork_def)
apply (simp add: DeadlockFree_def)
apply (simp add: isDeadlockStateOf_def)
apply (subgoal_tac "Union (snd ` PXf ` I) = {a. EX i:I. a : snd (FXf i)}")
                                               (* ... sub 1 *)

 apply (elim conjE exE)
 apply (simp add: PAR_def)
 apply (simp add: in_failures_par)
 apply (elim conjE exE)

 apply (subgoal_tac
   "EX Zf. ALL i:I. (s rest-tr (snd (FXf i)), Zf i) :  fst (FXf i) &
           ((Yf i) Int (Ev ` snd (FXf i))) <= Zf i &
           Zf i <= (Ev ` snd (FXf i))")
                                               (* ... sub 2 *)
  apply (elim conjE exE)

 apply (rule_tac x="s" in exI)
 apply (rule_tac x="Zf" in exI)
 apply (rule conjI)

  apply (simp add: isStateOf_def)
  apply (simp add: ALP_def)
  apply (simp add: subset_insert)

  (* set *)
  apply (simp add: ALP_def)
  apply (simp add: isFailureOf_def)
  apply (simp add: Int_insert_eq)
  apply (rule)
   (* <= *)
   apply (rotate_tac -3)
   apply (drule sym)
   apply (simp)
   apply (rule)
   apply (simp)
   apply (elim conjE exE)
   apply (simp)
   apply (rotate_tac 1)
   apply (drule_tac x="i" in bspec, simp)
   apply (elim conjE)

   apply (rule rev_subsetD)
   apply (simp)
   apply (simp)
   apply (rule order_trans)
   apply (simp)

   apply (rule)
   apply (simp add: image_iff)
   apply (elim conjE bexE)
   apply (simp)
   apply (rule_tac x="i" in bexI)
   apply (simp)
   apply (simp)

   (* => *)
   apply (rule)
   apply (simp)
   apply (elim conjE bexE exE)
   apply (simp)
   apply (rule_tac x="Zf i" in exI)
   apply (rule conjI)
   apply (fast)

   apply (elim conjE disjE)
    apply (drule_tac x="i" in bspec, simp)
    apply (simp)
    apply (subgoal_tac
      "Tick : Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I}")
     apply (rotate_tac 5)
     apply (drule sym)
     apply (simp add: image_iff)
    apply (simp)
    apply (rule_tac x="Yf i Int insert Tick (Ev ` snd (PXf i))" in exI, simp)
    apply (rule_tac x="i" in exI, simp)

    apply (rotate_tac -5)
    apply (drule_tac x="i" in bspec, simp)
    apply (elim conjE disjE)
    apply (rule subsetD)
    apply (simp)
    apply (fast)

 (* sub 2 *)
 apply (simp add: DeadlockState_notDeadlockFree_only_if_lmEX)

(* sub 1 *)
apply (simp add: isFailureOf_def)
apply (auto)
done

(*** if part ***)

lemma DeadlockState_notDeadlockFree_if:
  "[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) ;
      EX sigma. (sigma isDeadlockStateOf (I,FXf)) |]
   ==> ~ DeadlockFreeNetwork (I,PXf)"
apply (simp add: DeadlockFreeNetwork_def)
apply (simp add: DeadlockFree_def)
apply (simp add: isDeadlockStateOf_def)

apply (elim conjE exE)
apply (simp add: PAR_def)

apply (rule_tac x="a" in exI)
apply (simp add: in_failures_par)
apply (simp add: isStateOf_def ALP_def)

apply (elim conjE exE)
apply (rule conjI)
apply (fast)
apply (rule conjI)

apply (rule order_trans)
apply (simp)
apply (simp add: isFailureOf_def)
apply (fast)

apply (rule_tac x="b" in exI)
apply (rename_tac s Ys)
apply (drule sym)
apply (simp)
apply (subgoal_tac "Union (snd ` PXf ` I) = {a. EX i:I. a : snd (PXf i)}")
apply (simp add: Int_insert_eq)
apply (rule conjI)
 apply (rule)

 (* <= *)
  apply (rule)
   apply (simp add: image_iff)
   apply (elim conjE exE bexE)
   apply (simp)
   apply (subgoal_tac "x : Ev ` {a. EX i:I. a : snd (FXf i)}")

    apply (simp)
    apply (elim conjE exE)
    apply (rule_tac x="Ys ia Int insert Tick (Ev ` snd (PXf ia))" in exI)
    apply (rule conjI)
    apply (fast)

    apply (simp)
    apply (drule_tac x="ia" in bspec, simp)
    apply (simp add: isFailureOf_same_alpha)
    apply (blast)

   apply (simp (no_asm) add: image_iff)
   apply (rule_tac x="xa" in exI)
   apply (simp add: isFailureOf_def)
   apply (force)

 (* => *)
  apply (rule)
   apply (simp)
   apply (elim conjE exE)
   apply (simp add: image_iff)
   apply (elim disjE conjE exE)
    apply (drule_tac x="i" in bspec, simp)
    apply (force)

    apply (elim conjE bexE)
    apply (rule_tac x="xb" in exI, simp)
    apply (rule_tac x="i" in bexI)
    apply (simp)
    apply (simp)

apply (intro ballI)
apply (simp add: isFailureOf_def)
apply (simp add: subseteqEX_restRefusal_iff)

apply (auto)
done

(*** iff ***)

lemma DeadlockState_notDeadlockFree:
  "[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) |]
   ==> (~ DeadlockFreeNetwork (I,PXf)) =
       (EX sigma. (sigma isDeadlockStateOf (I,FXf)))"
apply (rule)
apply (rule DeadlockState_notDeadlockFree_only_if, simp_all)
apply (simp add: DeadlockState_notDeadlockFree_if)
done

(*** DeadlockFree ***)

lemma DeadlockFree_notDeadlockState:
  "[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) |]
   ==> DeadlockFreeNetwork (I,PXf) =
       (ALL sigma. ~(sigma isDeadlockStateOf (I,FXf)))"
apply (rule iffI)
apply (rotate_tac -1)
apply (erule contrapos_pp)
apply (simp add: DeadlockState_notDeadlockFree)
apply (rotate_tac -1)
apply (erule contrapos_pp)
apply (simp add: DeadlockState_notDeadlockFree)
done

(****************** to add it again ******************)

declare disj_not1   [simp]
(*
declare Union_image_eq [simp]
declare Inter_image_eq [simp]
*)
declare Sup_image_eq [simp]
declare Inf_image_eq [simp]
end


(*  Title:      HOL/HOLCF/IOA/Storage/Correctness.thy
    Author:     Olaf Müller
*)

section \<open>Correctness Proof\<close>

theory Correctness
imports IOA.SimCorrectness Spec Impl
begin

default_sort type

definition
  sim_relation :: "((nat * bool) * (nat set * bool)) set" where
  "sim_relation = {qua. let c = fst qua; a = snd qua ;
                            k = fst c;   b = snd c;
                            used = fst a; c = snd a
                        in
                        (\<forall>l\<in>used. l < k) \<and> b=c}"

declare split_paired_Ex [simp del]

(* Idea: instead of impl_con_lemma do not rewrite impl_ioa, but derive
         simple lemmas asig_of impl_ioa = impl_sig, trans_of impl_ioa = impl_trans
   Idea: ?ex. move .. should be generally replaced by a step via a subst tac if desired,
         as this can be done globally *)

lemma issimulation:
      "is_simulation sim_relation impl_ioa spec_ioa"
apply (simp (no_asm) add: is_simulation_def)
apply (rule conjI)
txt \<open>start states\<close>
apply (auto)[1]
apply (rule_tac x = " ({},False) " in exI)
apply (simp add: sim_relation_def starts_of_def spec_ioa_def impl_ioa_def)
txt \<open>main-part\<close>
apply (rule allI)+
apply (rule imp_conj_lemma)
apply (rename_tac k b used c k' b' a)
apply (induct_tac "a")
apply (simp_all (no_asm) add: sim_relation_def impl_ioa_def impl_trans_def trans_of_def)
apply auto
txt \<open>NEW\<close>
apply (rule_tac x = "(used,True)" in exI)
apply simp
apply (rule transition_is_ex)
apply (simp (no_asm) add: spec_ioa_def spec_trans_def trans_of_def)
txt \<open>LOC\<close>
apply (rule_tac x = " (used Un {k},False) " in exI)
apply (simp add: less_SucI)
apply (rule transition_is_ex)
apply (simp (no_asm) add: spec_ioa_def spec_trans_def trans_of_def)
apply fast
txt \<open>FREE\<close>
apply (rename_tac nat, rule_tac x = " (used - {nat},c) " in exI)
apply simp
apply (rule transition_is_ex)
apply (simp (no_asm) add: spec_ioa_def spec_trans_def trans_of_def)
done

lemma implementation:
"impl_ioa =<| spec_ioa"
apply (unfold ioa_implements_def)
apply (rule conjI)
apply (simp (no_asm) add: impl_sig_def spec_sig_def impl_ioa_def spec_ioa_def
  asig_outputs_def asig_of_def asig_inputs_def)
apply (rule trace_inclusion_for_simulations)
apply (simp (no_asm) add: impl_sig_def spec_sig_def impl_ioa_def spec_ioa_def
  externals_def asig_outputs_def asig_of_def asig_inputs_def)
apply (rule issimulation)
done

end


(*  Title:       CoreC++
    Author:      Daniel Wasserrab
    Maintainer:  Daniel Wasserrab <wasserra at fmi.uni-passau.de>
    Based on the Jinja theory J/Expr.thy by Tobias Nipkow
*)

header {* \isaheader{Expressions} *}

theory Expr imports Value begin

section {* The expressions *}

datatype bop = Eq | Add     -- "names of binary operations"

datatype expr
  = new cname            -- "class instance creation"
  | Cast cname expr      -- "dynamic type cast"
  | StatCast cname expr  -- "static type cast"
                                 ("\<lparr>_\<rparr>_" [80,81] 80)
  | Val val              -- "value"
  | BinOp expr bop expr          ("_ \<guillemotleft>_\<guillemotright> _" [80,0,81] 80)
     -- "binary operation"
  | Var vname            -- "local variable"
  | LAss vname expr              ("_:=_" [70,70] 70)
     -- "local assignment"
  | FAcc expr vname path         ("_\<bullet>_{_}" [10,90,99] 90)
     -- "field access"
  | FAss expr vname path expr    ("_\<bullet>_{_} := _" [10,70,99,70] 70)
     -- "field assignment"
  | Call expr "cname option" mname "expr list"
     -- "method call"
  | Block vname ty expr          ("'{_:_; _}")
  | Seq expr expr                ("_;;/ _" [61,60] 60)
  | Cond expr expr expr          ("if '(_') _/ else _" [80,79,79] 70)
  | While expr expr              ("while '(_') _" [80,79] 70)
  | throw expr

abbreviation (input)
  DynCall :: "expr \<Rightarrow> mname \<Rightarrow> expr list \<Rightarrow> expr" ("_\<bullet>_'(_')" [90,99,0] 90) where
  "e\<bullet>M(es) == Call e None M es"

abbreviation (input)
  StaticCall :: "expr \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> expr list \<Rightarrow> expr"
     ("_\<bullet>'(_::')_'(_')" [90,99,99,0] 90) where
  "e\<bullet>(C::)M(es) == Call e (Some C) M es"

text{* The semantics of binary operators: *}

fun binop :: "bop \<times> val \<times> val \<Rightarrow> val option" where
  "binop(Eq,v\<^sub>1,v\<^sub>2) = Some(Bool (v\<^sub>1 = v\<^sub>2))"
| "binop(Add,Intg i\<^sub>1,Intg i\<^sub>2) = Some(Intg(i\<^sub>1+i\<^sub>2))"
| "binop(bop,v\<^sub>1,v\<^sub>2) = None"

lemma binop_not_ref[simp]:
  "binop(bop,v\<^sub>1,v\<^sub>2) = Some (Ref r) \<Longrightarrow> False"
by(cases bop)auto

section{*Free Variables*}

primrec
  fv  :: "expr      \<Rightarrow> vname set"
  and fvs :: "expr list \<Rightarrow> vname set" where
  "fv(new C) = {}"
| "fv(Cast C e) = fv e"
|  "fv(\<lparr>C\<rparr>e) = fv e"
| "fv(Val v) = {}"
| "fv(e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2) = fv e\<^sub>1 \<union> fv e\<^sub>2"
| "fv(Var V) = {V}"
| "fv(V := e) = {V} \<union> fv e"
| "fv(e\<bullet>F{Cs}) = fv e"
| "fv(e\<^sub>1\<bullet>F{Cs}:=e\<^sub>2) = fv e\<^sub>1 \<union> fv e\<^sub>2"
| "fv(Call e Copt M es) = fv e \<union> fvs es"
| "fv({V:T; e}) = fv e - {V}"
| "fv(e\<^sub>1;;e\<^sub>2) = fv e\<^sub>1 \<union> fv e\<^sub>2"
| "fv(if (b) e\<^sub>1 else e\<^sub>2) = fv b \<union> fv e\<^sub>1 \<union> fv e\<^sub>2"
| "fv(while (b) e) = fv b \<union> fv e"
| "fv(throw e) = fv e"

| "fvs([]) = {}"
| "fvs(e#es) = fv e \<union> fvs es"

lemma [simp]: "fvs(es\<^sub>1 @ es\<^sub>2) = fvs es\<^sub>1 \<union> fvs es\<^sub>2"
by (induct es\<^sub>1 type:list) auto

lemma [simp]: "fvs(map Val vs) = {}"
by (induct vs) auto

end