theory sas_df
imports "sas_analysis"
        "CSP_F.CSP_F_law_step_aux"
        "DFP_DFfive"
begin

overloading Set_FPmode ==
  "CSP_syntax.FPmode :: fpmode"
begin
  definition "CSP_syntax.FPmode == CMSmode"
end
declare Set_FPmode_def [simp add]

declare inj_def [simp add]
declare Let_def [simp add]

declare Rec_prefix_def [simp add]
declare Send_prefix_def [simp add]

fun DFfive_to_ACE_PCUadj :: "ActuatorId \<Rightarrow> DFfivePN \<Rightarrow> (PN, Events) proc"
where
    "DFfive_to_ACE_PCUadj i (DFfive) =
           (!<adjust i> adj .. !<rawPosition i> p0 ..
             $ACE i
             |[ {| servoCmd i, feedbackPos i |}\<^sub>c ]|
             PCUadj i p0 adj)"

lemma Lemma_DFfive_to_ACE_PCUadj :
    "(DFfivefun p) << (DFfive_to_ACE_PCUadj i) <=F DFfive_to_ACE_PCUadj i p"
  apply (induct_tac p)
  apply (auto)

  (* Expand RIGHT *)
  apply (rule cspF_rw_right, rule unwind_ACE_PCUadj)
  apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
    apply (rule cspF_reflex, rule cspF_reflex, simp)
    apply (cspF_simp_right)

  (* STEP - controlCmd OR adjust is the 1\<ordmasculine> event *)
  apply (rule cspF_Ext_choice_right)

    (* REFINED - controlCmd is the 1\<ordmasculine> event *)
    apply (cspF_step_left)
    apply (rule cspF_decompo_ref, simp, simp)
    apply (erule rangeE, simp)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex, rule cspF_reflex, simp)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

      (* REFINED - adjust is the 2\<ordmasculine> event *)
      apply (cspF_step_left)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (simp)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
          apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
            apply (rule unwind_EHSV)
            apply (rule cspF_rw_left, rule unwind_Raw)
            apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
            apply (simp)
            apply (cspF_simp_left)
            apply (cspF_simp_left)
          apply (rule unwind_LVDT)
          apply (simp)
          apply (cspF_simp_left)
          apply (cspF_simp_left)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

      (* REFINED - rawPosition is the 3\<ordmasculine> event *)
      apply (cspF_step_left)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (simp)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex, simp)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
          apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
          apply (rule cspF_reflex, cspF_simp_left)
          apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
          apply (simp)
          apply (cspF_simp_left)
          apply (cspF_simp_left)
        apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
        apply (simp)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

      (* REFINED - feedbackPos is the 5\<ordmasculine> event *)
      apply (cspF_step_left)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (simp)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex)
        apply (cspF_simp_left)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
          apply (rule cspF_reflex, rule unwind_LVDT, simp)
          apply (cspF_simp_left)
          apply (cspF_simp_left)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

      (* REFINED - servoCmd is the 6\<ordmasculine> event *)
      apply (cspF_step_left)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (simp)

      apply (rule cspF_Rep_int_choice_left, simp)
      apply (rule_tac x="(saturate (aa + a) - disp (dOmega (saturate (x - saturate (aa + a)))))" in exI, simp)
      apply (rule cspF_Rep_int_choice_left, simp)
      apply (rule_tac x="(saturate (aa + a))" in exI, simp)

      apply (rule cspF_decompo, simp, simp)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
          apply (rule cspF_reflex, rule cspF_reflex, simp)
          apply (cspF_simp_left)
          apply (cspF_simp_left)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

      apply (simp add: PCUadj_def)
      apply (rule cspF_decompo, simp, simp)
      apply (rule cspF_decompo, simp)
      apply (rule cspF_decompo, simp, simp)
      apply (rule cspF_rw_right, rule cspF_IF, simp)
      apply (rule cspF_eq_ref, rule unwind_LVDT)

    (* REFINED - adjust is the 1\<ordmasculine> event *)
    apply (cspF_step_left)
    apply (rule cspF_decompo_ref, simp, simp)
    apply (simp)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
          apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
          apply (rule unwind_EHSV)
          apply (rule cspF_rw_left, rule unwind_Raw)
          apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
          apply (simp)
          apply (cspF_simp_left)
          apply (cspF_simp_left)
        apply (rule unwind_LVDT)
        apply (simp)
        apply (cspF_simp_left)
        apply (cspF_simp_left)
      apply (cspF_simp_right)

      (* STEP - controlCmd OR rawPosition is the 2\<ordmasculine> event *)
      apply (rule cspF_Ext_choice_right)

      (* REFINED - controlCmd is the 2\<ordmasculine> event *)
      apply (cspF_step_left)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (erule rangeE, simp)

        (* Expand RIGHT *)
        apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
          apply (rule cspF_reflex, rule cspF_reflex, simp)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

        (* REFINED - rawPosition is the 3\<ordmasculine> event *)
        apply (cspF_step_left)
        apply (rule cspF_decompo_ref, simp, simp)
        apply (simp)

        (* Expand RIGHT *)
        apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
          apply (rule cspF_reflex)
          apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
            apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
            apply (rule cspF_reflex, cspF_simp_left)
            apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
            apply (simp)
              apply (cspF_simp_left)
              apply (cspF_simp_left)
          apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
          apply (simp)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

        (* REFINED - feedbackPos is the 4\<ordmasculine> event *)
        apply (cspF_step_left)
        apply (rule cspF_decompo_ref, simp, simp)
        apply (simp)

        (* Expand RIGHT *)
        apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
          apply (rule cspF_reflex, cspF_simp_left)
          apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
          apply (rule cspF_reflex, rule unwind_LVDT, simp)
          apply (cspF_simp_left)
          apply (cspF_simp_left)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

        (* REFINED - servoCmd is the 5\<ordmasculine> event *)
        apply (cspF_step_left)
        apply (rule cspF_decompo_ref, simp, simp)
        apply (simp)

        apply (rule cspF_Rep_int_choice_left, simp)
        apply (rule_tac x="saturate (aa + a) - disp (dOmega (saturate (x - saturate (aa + a))))" in exI, simp)
        apply (rule cspF_Rep_int_choice_left, simp)
        apply (rule_tac x="(saturate (aa + a))" in exI, simp)

        apply (rule cspF_decompo, simp, simp)

        (* Expand RIGHT *)
        apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
          apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
            apply (rule cspF_reflex, rule cspF_reflex, simp)
            apply (cspF_simp_left)
            apply (cspF_simp_left)
          apply (cspF_simp_right)
          apply (cspF_simp_right)

        (* REFINED *)
        apply (simp add: PCUadj_def)
        apply (rule cspF_decompo, simp, simp)
        apply (rule cspF_decompo, simp)
        apply (rule cspF_decompo, simp, simp)
        apply (rule cspF_rw_right, rule cspF_IF, simp)
        apply (rule cspF_eq_ref, rule unwind_LVDT)

      (* REFINED - rawPosition is the 2\<ordmasculine> event *)
      apply (cspF_step_left)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (simp)

        (* Expand RIGHT *)
        apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
          apply (rule cspF_reflex)
          apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
            apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
            apply (rule cspF_reflex)
            apply (cspF_simp_left)
            apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
            apply (simp)
            apply (cspF_simp_left)
            apply (cspF_simp_left)
          apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
          apply (simp)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

        (* REFINED - controlCmd is the 3\<ordmasculine> event *)
        apply (cspF_step_left)
        apply (rule cspF_decompo_ref, simp, simp)
        apply (erule rangeE, simp)

        (* Expand RIGHT *)
        apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
          apply (rule cspF_reflex, rule cspF_reflex, simp)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

        (* REFINED - feedbackPos is the 4\<ordmasculine> event *)
        apply (cspF_step_left)
        apply (rule cspF_decompo_ref, simp, simp)
        apply (simp)

        (* Expand RIGHT *)
        apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex)
        apply (rule cspF_rw_left, rule cspF_IF)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex)
        apply (rule unwind_LVDT)
        apply (simp)
        apply (cspF_simp_left)
        apply (cspF_simp_left)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

        (* REFINED - servoCmd is the 5\<ordmasculine> event *)
        apply (cspF_step_left)
        apply (rule cspF_decompo_ref, simp, simp)
        apply (simp)

        apply (rule cspF_Rep_int_choice_left, simp)
        apply (rule_tac x="(saturate (aa + a) - disp (dOmega (saturate (x - saturate (aa + a)))))" in exI, simp)
        apply (rule cspF_Rep_int_choice_left, simp)
        apply (rule_tac x="(saturate (aa + a))" in exI, simp)

        apply (rule cspF_decompo, simp, simp)

        (* Expand RIGHT *)
        apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex)
        apply (rule cspF_reflex)
        apply (simp)
        apply (rule cspF_rw_left, rule cspF_Ext_choice_unit_r_hsf)
        apply (rule cspF_rw_left, rule cspF_Ext_choice_unit_r_hsf)
        apply (rule cspF_reflex)
        apply (rule cspF_reflex)
        apply (simp)
        apply (cspF_simp_right)
        apply (cspF_simp_right)

        (* REFINED *)
        apply (simp add: PCUadj_def)
        apply (rule cspF_decompo, simp, simp)
        apply (rule cspF_decompo, simp)
        apply (rule cspF_decompo, simp, simp)
        apply (rule cspF_rw_right, rule cspF_IF, simp)
        apply (rule cspF_eq_ref, rule unwind_LVDT)
done

lemma DFtick_ACE_PCUadj : "$DFtick <=F ((ACE_PCUadj i p adj)::(PN,Events) proc)"
  apply (rule cspF_trans, rule DFtick_DFfive)
  apply (rule_tac Pf="DFfivefun" and f="DFfive_to_ACE_PCUadj i" in cspF_fp_induct_ref_left)
  apply (simp, simp, simp, simp)
  apply (rule cspF_Rep_int_choice_left, simp)
    apply (rule_tac  x="adj" in exI, simp)
  apply (rule cspF_Rep_int_choice_left, simp)
    apply (rule_tac  x="p" in exI, simp)
  apply (simp add: ACE_PCUadj_def)
  by (rule Lemma_DFfive_to_ACE_PCUadj)

lemma DF_ACE_PCU : "$DFtick <=F ((ACE_PCU i p)::(PN,Events) proc)"
  (* Expand RIGHT *)
  apply (rule cspF_rw_right, rule unwind_ACE_PCU)
    apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
      apply (rule cspF_reflex)
      (* PCU = ( EHSV |[ ... ]| Raw ) |[ ... ]| LVDT *)
      apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
       apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex)
        apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
        apply (simp)
       apply (cspF_simp_left)
        apply (cspF_simp_left)
        apply (cspF_simp_left)
        apply (cspF_simp_right)
    apply (rule cspF_rw_right, rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)

    (* 1\<ordmasculine> STEP IS REFINED - rawPosition OR controlCmd is the first event*)
    apply (cspF_unwind_left, cspF_step_left, rule cspF_Int_choice_left1)
    apply (rule cspF_decompo_ref, simp, simp)
    apply (clarsimp, erule disjE)

    (* rawPosition is the first event *)
    apply (simp)
    apply (cspF_simp_right)
    apply (cspF_simp_right)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
          apply (rule cspF_reflex)
          apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
          apply (simp)
        apply (cspF_simp_left)
        apply (cspF_simp_left)
      apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
      apply (simp)
      apply (cspF_simp_right)
      apply (cspF_simp_right)

      (* 2\<ordmasculine> STEP IS REFINED - controlCmd is the second event *)
      apply (cspF_unwind_left, cspF_step_left, rule cspF_Int_choice_left1)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (erule rangeE, simp)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex, rule cspF_reflex, simp)
      apply (cspF_simp_right)
      apply (cspF_simp_right)

      (* 3\<ordmasculine> STEP IS REFINED - feedbackPos is the third event *)
      apply (cspF_unwind_left, cspF_step_left, rule cspF_Int_choice_left1)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (simp)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex, cspF_simp_left)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex, rule unwind_LVDT, simp)
        apply (cspF_simp_left)
        apply (cspF_simp_left)
      apply (cspF_simp_right)
      apply (cspF_simp_right)

      (* 4\<ordmasculine> STEP IS REFINED - servoCmd is the fourth event *)
      apply (cspF_unwind_left, cspF_step_left, rule cspF_Int_choice_left1)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (simp)

      (* REFINED BY TRANS DFtick_ACE_PCUadj *)
      apply (rule cspF_trans)
      apply (rule_tac i="i" and p="p" and adj="(p - disp (dOmega (saturate (x - p))))" in DFtick_ACE_PCUadj)
      apply (simp add: ACE_PCUadj_def)
      apply (rule cspF_decompo, simp, simp)
      apply (simp add: PCUadj_def)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
      apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
       apply (rule cspF_reflex, rule cspF_reflex, simp)
        apply (cspF_simp_left)
        apply (cspF_simp_left)
      apply (cspF_simp_right)
      apply (cspF_simp_right)

      (* REFINED BY DECOMPO *)
      apply (rule cspF_decompo, simp, simp)
      apply (rule cspF_decompo, simp)
      apply (rule cspF_decompo, simp, simp)
      apply (cspF_simp_right)
      apply (rule cspF_eq_ref, rule unwind_LVDT)

    (* controlCmd is the first event *)
    apply (cspF_simp_right)
    apply (erule rangeE, simp)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
      apply (rule cspF_reflex, rule cspF_reflex, simp)
      apply (cspF_simp_right)
      apply (cspF_simp_right)

      (* 2\<ordmasculine> STEP IS REFINED - rawPosition is the second event *)
      apply (cspF_unwind_left, cspF_step_left, rule cspF_Int_choice_left1)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (simp)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
          apply (rule cspF_reflex)
          apply (rule cspF_rw_left, rule cspF_IF)
            apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
          apply (simp)
        apply (cspF_simp_left)
        apply (cspF_simp_left)
        apply (rule cspF_Ext_choice_step_Ext_pre_choice_disjnt, simp add: disjnt_def)
        apply (simp)
      apply (cspF_simp_right)
      apply (cspF_simp_right)

      (* 3\<ordmasculine> STEP IS REFINED - feedbackPos is the third event *)
      apply (cspF_unwind_left, cspF_step_left, rule cspF_Int_choice_left1)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (simp)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex, cspF_simp_left)
      apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
        apply (rule cspF_reflex, rule unwind_LVDT, simp)
      apply (cspF_simp_left)
      apply (cspF_simp_left)
      apply (cspF_simp_right)
      apply (cspF_simp_right)

      (* 4\<ordmasculine> STEP IS REFINED - servoCmd is the fourth event *)
      apply (cspF_unwind_left, cspF_step_left, rule cspF_Int_choice_left1)
      apply (rule cspF_decompo_ref, simp, simp)
      apply (simp)

      (* REFINED BY TRANS DFtick_ACE_PCUadj *)
      apply (rule cspF_trans)
      apply (rule_tac i="i" and p="p" and adj="(p - disp (dOmega (saturate (x - p))))" in DFtick_ACE_PCUadj)
      apply (simp add: ACE_PCUadj_def)
      apply (rule cspF_decompo, simp, simp)
      apply (simp add: PCUadj_def)

      (* Expand RIGHT *)
      apply (rule cspF_rw_right, rule cspF_Parallel_step_choice)
        apply (rule cspF_rw_left, rule cspF_Parallel_step_choice)
         apply (rule cspF_reflex, rule cspF_reflex, simp)
        apply (cspF_simp_left)
        apply (cspF_simp_left)
      apply (cspF_simp_right)
      apply (cspF_simp_right)

      (* REFINED BY DECOMPO *)
      apply (rule cspF_decompo, simp, simp)
      apply (rule cspF_decompo, simp)
      apply (rule cspF_decompo, simp, simp)
      apply (cspF_simp_right)
      apply (rule cspF_eq_ref, rule unwind_LVDT)
  done

lemma DF_ACE_PCU_isDeadlockFree : "((ACE_PCU i p)::(PN,Events) proc) isDeadlockFree"
  apply (simp only: DeadlockFree_DFtick_ref)
  by (rule DF_ACE_PCU)

theorem SimpleActuator_isDeadlockFree : "((SimpleActuator i)::(PN,Events) proc) isDeadlockFree"
  apply (simp only: SimpleActuator_def)
  by (rule DF_ACE_PCU_isDeadlockFree)

declare inj_def [simp del]
declare Let_def [simp del]

declare Rec_prefix_def [simp del]
declare Send_prefix_def [simp del]

end


section \<open>Correctness Theorem of Partial Order Reduction\<close>

theory Ample_Correctness
imports
  Ample_Abstract
  Formula
begin

  locale ample_correctness =
    S: transition_system_complete ex en init int +
    R: transition_system_complete ex ren init int +
    F: formula_next_free \<phi> +
    ample_abstract ex en init int ind src ren
    for ex :: "'action \<Rightarrow> 'state \<Rightarrow> 'state"
    and en :: "'action \<Rightarrow> 'state \<Rightarrow> bool"
    and init :: "'state \<Rightarrow> bool"
    and int :: "'state \<Rightarrow> 'interpretation"
    and ind :: "'action \<Rightarrow> 'action \<Rightarrow> bool"
    and src :: "'state \<Rightarrow> 'state \<Rightarrow> bool"
    and ren :: "'action \<Rightarrow> 'state \<Rightarrow> bool"
    and \<phi> :: "'interpretation pltl"
  begin

    lemma reduction_language_indistinguishable:
      assumes "R.language \<subseteq> F.language"
      shows "S.language \<subseteq> F.language"
    proof
      fix u
      assume 1: "u \<in> S.language"
      obtain v where 2: "v \<in> R.language" "snth u \<approx> snth v" using reduction_language_stuttering 1 by this
      have 3: "v \<in> F.language" using assms 2(1) by rule
      show "u \<in> F.language" using 2(2) 3 by auto
    qed

    theorem reduction_correct: "S.language \<subseteq> F.language \<longleftrightarrow> R.language \<subseteq> F.language"
      using reduction_language_subset reduction_language_indistinguishable by blast

  end

end


(*  Title:      HOL/Auth/n_germanSimp_lemma_on_inv__12.thy
    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
*)

header{*The n_germanSimp Protocol Case Study*}

theory n_germanSimp_lemma_on_inv__12 imports n_germanSimp_base
begin
section{*All lemmas on causal relation between inv__12 and some rule r*}
lemma n_SendInv__part__0Vsinv__12:
assumes a1: "(\<exists> i. i\<le>N\<and>r=n_SendInv__part__0  i)" and
a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
shows "invHoldForRule s f r (invariants N)" (is "?P1 s \<or> ?P2 s \<or> ?P3 s")
proof -
from a1 obtain i where a1:"i\<le>N\<and>r=n_SendInv__part__0  i" apply fastforce done
from a2 obtain p__Inv3 p__Inv4 where a2:"p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4" apply fastforce done
have "(i=p__Inv4)\<or>(i=p__Inv3)\<or>(i~=p__Inv3\<and>i~=p__Inv4)" apply (cut_tac a1 a2, auto) done
moreover {
  assume b1: "(i=p__Inv4)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i=p__Inv3)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i~=p__Inv3\<and>i~=p__Inv4)"
  have "?P2 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
ultimately show "invHoldForRule s f r (invariants N)" by satx
qed

lemma n_SendInv__part__1Vsinv__12:
assumes a1: "(\<exists> i. i\<le>N\<and>r=n_SendInv__part__1  i)" and
a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
shows "invHoldForRule s f r (invariants N)" (is "?P1 s \<or> ?P2 s \<or> ?P3 s")
proof -
from a1 obtain i where a1:"i\<le>N\<and>r=n_SendInv__part__1  i" apply fastforce done
from a2 obtain p__Inv3 p__Inv4 where a2:"p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4" apply fastforce done
have "(i=p__Inv4)\<or>(i=p__Inv3)\<or>(i~=p__Inv3\<and>i~=p__Inv4)" apply (cut_tac a1 a2, auto) done
moreover {
  assume b1: "(i=p__Inv4)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i=p__Inv3)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i~=p__Inv3\<and>i~=p__Inv4)"
  have "?P2 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
ultimately show "invHoldForRule s f r (invariants N)" by satx
qed

lemma n_SendInvAckVsinv__12:
assumes a1: "(\<exists> i. i\<le>N\<and>r=n_SendInvAck  i)" and
a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
shows "invHoldForRule s f r (invariants N)" (is "?P1 s \<or> ?P2 s \<or> ?P3 s")
proof -
from a1 obtain i where a1:"i\<le>N\<and>r=n_SendInvAck  i" apply fastforce done
from a2 obtain p__Inv3 p__Inv4 where a2:"p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4" apply fastforce done
have "(i=p__Inv4)\<or>(i=p__Inv3)\<or>(i~=p__Inv3\<and>i~=p__Inv4)" apply (cut_tac a1 a2, auto) done
moreover {
  assume b1: "(i=p__Inv4)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i=p__Inv3)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i~=p__Inv3\<and>i~=p__Inv4)"
  have "?P2 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
ultimately show "invHoldForRule s f r (invariants N)" by satx
qed

lemma n_SendGntSVsinv__12:
assumes a1: "(\<exists> i. i\<le>N\<and>r=n_SendGntS  i)" and
a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
shows "invHoldForRule s f r (invariants N)" (is "?P1 s \<or> ?P2 s \<or> ?P3 s")
proof -
from a1 obtain i where a1:"i\<le>N\<and>r=n_SendGntS  i" apply fastforce done
from a2 obtain p__Inv3 p__Inv4 where a2:"p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4" apply fastforce done
have "(i=p__Inv4)\<or>(i=p__Inv3)\<or>(i~=p__Inv3\<and>i~=p__Inv4)" apply (cut_tac a1 a2, auto) done
moreover {
  assume b1: "(i=p__Inv4)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i=p__Inv3)"
  have "?P3 s"
  apply (cut_tac a1 a2 b1, simp, rule_tac x="(neg (andForm (eqn (IVar (Ident ''ExGntd'')) (Const false)) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const GntE))))" in exI, auto) done
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i~=p__Inv3\<and>i~=p__Inv4)"
  have "?P2 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
ultimately show "invHoldForRule s f r (invariants N)" by satx
qed

lemma n_SendGntEVsinv__12:
assumes a1: "(\<exists> i. i\<le>N\<and>r=n_SendGntE N i)" and
a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
shows "invHoldForRule s f r (invariants N)" (is "?P1 s \<or> ?P2 s \<or> ?P3 s")
proof -
from a1 obtain i where a1:"i\<le>N\<and>r=n_SendGntE N i" apply fastforce done
from a2 obtain p__Inv3 p__Inv4 where a2:"p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4" apply fastforce done
have "(i=p__Inv4)\<or>(i=p__Inv3)\<or>(i~=p__Inv3\<and>i~=p__Inv4)" apply (cut_tac a1 a2, auto) done
moreover {
  assume b1: "(i=p__Inv4)"
  have "?P3 s"
  apply (cut_tac a1 a2 b1, simp, rule_tac x="(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv3) ''Cmd'')) (Const GntS)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv3)) (Const false))))" in exI, auto) done
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i=p__Inv3)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i~=p__Inv3\<and>i~=p__Inv4)"
  have "?P2 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
ultimately show "invHoldForRule s f r (invariants N)" by satx
qed

lemma n_RecvGntSVsinv__12:
assumes a1: "(\<exists> i. i\<le>N\<and>r=n_RecvGntS  i)" and
a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
shows "invHoldForRule s f r (invariants N)" (is "?P1 s \<or> ?P2 s \<or> ?P3 s")
proof -
from a1 obtain i where a1:"i\<le>N\<and>r=n_RecvGntS  i" apply fastforce done
from a2 obtain p__Inv3 p__Inv4 where a2:"p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4" apply fastforce done
have "(i=p__Inv4)\<or>(i=p__Inv3)\<or>(i~=p__Inv3\<and>i~=p__Inv4)" apply (cut_tac a1 a2, auto) done
moreover {
  assume b1: "(i=p__Inv4)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i=p__Inv3)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i~=p__Inv3\<and>i~=p__Inv4)"
  have "?P2 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
ultimately show "invHoldForRule s f r (invariants N)" by satx
qed

lemma n_RecvGntEVsinv__12:
assumes a1: "(\<exists> i. i\<le>N\<and>r=n_RecvGntE  i)" and
a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
shows "invHoldForRule s f r (invariants N)" (is "?P1 s \<or> ?P2 s \<or> ?P3 s")
proof -
from a1 obtain i where a1:"i\<le>N\<and>r=n_RecvGntE  i" apply fastforce done
from a2 obtain p__Inv3 p__Inv4 where a2:"p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4" apply fastforce done
have "(i=p__Inv4)\<or>(i=p__Inv3)\<or>(i~=p__Inv3\<and>i~=p__Inv4)" apply (cut_tac a1 a2, auto) done
moreover {
  assume b1: "(i=p__Inv4)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i=p__Inv3)"
  have "?P1 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
moreover {
  assume b1: "(i~=p__Inv3\<and>i~=p__Inv4)"
  have "?P2 s"
  proof(cut_tac a1 a2 b1, auto) qed
  then have "invHoldForRule s f r (invariants N)" by auto
}
ultimately show "invHoldForRule s f r (invariants N)" by satx
qed

lemma n_StoreVsinv__12:
  assumes a1: "\<exists> i d. i\<le>N\<and>d\<le>N\<and>r=n_Store  i d" and
  a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
  shows "invHoldForRule s f r (invariants N)"
  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done

lemma n_RecvInvAckVsinv__12:
  assumes a1: "\<exists> i. i\<le>N\<and>r=n_RecvInvAck  i" and
  a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
  shows "invHoldForRule s f r (invariants N)"
  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done

lemma n_RecvReqE__part__0Vsinv__12:
  assumes a1: "\<exists> i. i\<le>N\<and>r=n_RecvReqE__part__0 N i" and
  a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
  shows "invHoldForRule s f r (invariants N)"
  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done

lemma n_RecvReqE__part__1Vsinv__12:
  assumes a1: "\<exists> i. i\<le>N\<and>r=n_RecvReqE__part__1 N i" and
  a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
  shows "invHoldForRule s f r (invariants N)"
  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done

lemma n_RecvReqSVsinv__12:
  assumes a1: "\<exists> i. i\<le>N\<and>r=n_RecvReqS N i" and
  a2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__12  p__Inv3 p__Inv4)"
  shows "invHoldForRule s f r (invariants N)"
  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done

end


theory ReborrowInd
  imports BorrowStack
begin

inductive reborrow'
  :: "ref_kind \<Rightarrow> tag \<Rightarrow> tag \<Rightarrow> (ref_kind * tag set) stack \<Rightarrow> (ref_kind * tag set) stack \<Rightarrow> bool"
where
  DerivUniqueUnique:
    "reborrow' Unique deriv orig
      ((Unique, {orig}) # tail)
      ((Unique, {deriv}) # (Unique, {orig}) # tail)" |
  DerivUniqueSRW:
    "reborrow' SharedReadWrite deriv orig
      ((Unique, {orig}) # tail)
      ((SharedReadWrite, {deriv}) # (Unique, {orig}) # tail)" |
  DerivUniqueSRO:
    "reborrow' SharedReadOnly deriv orig
      ((Unique, {orig}) # tail)
      ((SharedReadOnly, {deriv}) # (Unique, {orig}) # tail)" |
  DerivSRWUnique:
    "orig \<in> ts
     \<Longrightarrow> reborrow' Unique deriv orig
      ((SharedReadWrite, ts) # tail)
      ((Unique, {deriv}) # (SharedReadWrite, ts) # tail)" |
  DerivSRWSRW:
    "orig \<in> ts
     \<Longrightarrow> reborrow' SharedReadWrite deriv orig
      ((SharedReadWrite, ts) # tail)
      ((SharedReadWrite, insert deriv ts) # tail)" |
  DerivSRWSRO:
    "orig \<in> ts
     \<Longrightarrow> reborrow' SharedReadOnly deriv orig
      ((SharedReadWrite, ts) # tail)
      ((SharedReadOnly, {deriv}) # (SharedReadWrite, ts) # tail)" |
  DerivSROSRO:
    "orig \<in> ts
     \<Longrightarrow> reborrow' SharedReadOnly deriv orig
      ((SharedReadOnly, ts) # tail)
      ((SharedReadOnly, insert deriv ts) # tail)" |
  DerivPop:
    "\<lbrakk>reborrow' k deriv orig tail stack; orig \<notin> snd entry\<rbrakk>
    \<Longrightarrow> reborrow' k deriv orig (entry # tail) stack"

lemma reborrow'_nonempty_src:
  "reborrow' k deriv orig stack stack' \<Longrightarrow> stack \<noteq> []"
  using reborrow'.simps by blast

lemma ex_reborrow'_writable:
  assumes
    "wf_reborrow stack"
    "writable orig stack"
  shows "\<exists>stack'. reborrow' k deriv orig stack stack'"
using assms proof (induction rule: wf_reborrow_induct')
  case (Root t)
  then show ?case
    by (metis (full_types) DerivUniqueSRO DerivUniqueSRW DerivUniqueUnique empty_iff insert_iff
        ref_kind.exhaust writable.simps(1) writable.simps(2))
next
  case (UniqueUnique t t' tail)
  then show ?case
    by (metis (full_types) DerivPop DerivUniqueSRO DerivUniqueSRW DerivUniqueUnique
        ref_kind.exhaust singletonD snd_conv writable.simps(2))
next
  case (UniqueSRW t ts' tail)
  then show ?case
    by (metis (full_types) DerivPop DerivSRWSRO DerivSRWSRW DerivSRWUnique
        ref_kind.exhaust snd_eqD writable.simps(2))
next
  case (UniqueSRO t ts' tail)
  then show ?case
    by (metis DerivPop ref_kind.distinct(3) ref_kind.distinct(5) snd_conv writable.simps(2))
next
  case (SRWUnique ts t' tail)
  then show ?case
    by (metis (full_types) DerivPop DerivUniqueSRO DerivUniqueSRW DerivUniqueUnique
        ref_kind.exhaust singletonD snd_eqD writable.simps(2))
next
  case (SRWSRO ts ts' tail)
  then show ?case
    by (metis DerivPop ref_kind.distinct(3) ref_kind.distinct(5) sndI writable.simps(2))
qed

lemma ex_reborrow'_readable:
  assumes
    "wf_reborrow stack"
    "readable orig stack"
    "k = SharedReadOnly"
  shows "\<exists>stack'. reborrow' k deriv orig stack stack'"
using assms proof (induction rule: wf_reborrow_induct')
  case (Root t)
  then show ?case using DerivUniqueSRO by auto
next
  case (UniqueUnique t t' tail)
  then show ?case
  proof (cases "t' = orig")
    case True
    then show ?thesis using UniqueUnique DerivUniqueSRO by auto
  next
    case False
    then show ?thesis
    proof -
      obtain stack' where
        "reborrow' k deriv orig ((Unique, {t}) # tail) stack'"
        using UniqueUnique False by auto
      then show ?thesis using False DerivPop by force
    qed
  qed
next
  case (UniqueSRW t ts' tail)
  then show ?case
  proof (cases "orig \<in> ts'")
    case True
    then show ?thesis using UniqueSRW DerivSRWSRO by blast
  next
    case False
    then show ?thesis
    proof -
      obtain stack' where
        "reborrow' k deriv orig ((Unique, {t}) # tail) stack'"
        using UniqueSRW False by auto
      then show ?thesis using False DerivPop by force
    qed
  qed
next
  case (UniqueSRO t ts' tail)
  then show ?case
  proof (cases "orig \<in> ts'")
    case True
    then show ?thesis using UniqueSRO DerivSROSRO by blast
  next
    case False
    then show ?thesis
    proof -
      obtain stack' where
        "reborrow' k deriv orig ((Unique, {t}) # tail) stack'"
        using UniqueSRO False by auto
      then show ?thesis using False DerivPop by force
    qed
  qed
next
  case (SRWUnique ts t' tail)
  then show ?case
  proof (cases "t' = orig")
    case True
    then show ?thesis using SRWUnique DerivUniqueSRO by auto
  next
    case False
    then show ?thesis
    proof -
      obtain stack' where
        "reborrow' k deriv orig ((SharedReadWrite, ts) # tail) stack'"
        using SRWUnique False by auto
      then show ?thesis using False DerivPop by force
    qed
  qed
next
  case (SRWSRO ts ts' tail)
  then show ?case
  proof (cases "orig \<in> ts'")
    case True
    then show ?thesis using SRWSRO DerivSROSRO by blast
  next
    case False
    then show ?thesis
    proof -
      obtain stack' where
        "reborrow' k deriv orig ((SharedReadWrite, ts) # tail) stack'"
        using SRWSRO False by auto
      then show ?thesis using False DerivPop by force
    qed
  qed
qed

fun reborrow_ind
  :: "ref_kind \<Rightarrow> tag \<Rightarrow> tag \<Rightarrow> (ref_kind * tag set) stack \<Rightarrow> (ref_kind * tag set) stack" where
  "reborrow_ind k deriv orig stack = (THE stack'. reborrow' k deriv orig stack stack')"

lemma reborrow_by_comp[simp, intro]:
  assumes "reborrow' k deriv orig stack stack'"
  shows "reborrow_comp k deriv orig stack = stack'"
using assms proof (induction rule: reborrow'.induct)
qed auto

lemma the_reborrow_by_comp[simp, intro]:
  assumes "reborrow' k deriv orig stack (reborrow_comp k deriv orig stack)"
  shows "(THE stack'. reborrow' k deriv orig stack stack') = reborrow_comp k deriv orig stack"
  using assms reborrow_by_comp by blast

lemma the_reborrow_by_comp'[simp, intro]:
  assumes "reborrow' k deriv orig stack (reborrow_comp k deriv orig stack)"
  shows "The (reborrow' k deriv orig stack) = reborrow_comp k deriv orig stack"
  using assms the_reborrow_by_comp by simp

lemma reborrow_unique:
  assumes
    "reborrow' k deriv orig stack stack'"
    "reborrow' k deriv orig stack stack''"
  shows "stack' = stack''"
  using assms(1) assms(2) reborrow_by_comp by blast

lemma ex1_reborrow'_writable:
  assumes
    "wf_reborrow stack"
    "writable orig stack"
  shows "\<exists>!stack'. reborrow' k deriv orig stack stack'"
proof -
  obtain stack' where
    *: "reborrow' k deriv orig stack stack'"
    using assms ex_reborrow'_writable by blast
  moreover have "\<forall>stack''. reborrow' k deriv orig stack stack'' \<longrightarrow> stack'' = stack'"
    using reborrow_unique * by auto
  ultimately show ?thesis by blast
qed

lemma ex1_reborrow'_readable:
  assumes
    "wf_reborrow stack"
    "readable orig stack"
    "k = SharedReadOnly"
  shows "\<exists>!stack'. reborrow' k deriv orig stack stack'"
proof -
  obtain stack' where
    *: "reborrow' k deriv orig stack stack'"
    using assms ex_reborrow'_readable by blast
  moreover have "\<forall>stack''. reborrow' k deriv orig stack stack'' \<longrightarrow> stack'' = stack'"
    using reborrow_unique * by auto
  ultimately show ?thesis by blast
qed

lemma the_reborrow'_writable:
  assumes
    "wf_reborrow stack"
    "writable orig stack"
  shows "\<exists>!stack'. reborrow' k deriv orig stack stack'"
  using assms ex_reborrow'_writable reborrow_unique by auto

lemma the_reborrow'_readable:
  assumes
    "wf_reborrow stack"
    "readable orig stack"
    "k = SharedReadOnly"
  shows "\<exists>!stack'. reborrow' k deriv orig stack stack'"
  using assms ex_reborrow'_readable reborrow_unique by fastforce

lemma reborrow'_hd:
  assumes "reborrow' k deriv orig stack stack'"
  shows "k = fst (hd stack') \<and> deriv \<in> snd (hd stack')"
using assms proof (induction rule: reborrow'.induct, auto)
qed

lemma wf_reborrow_reborrow':
  assumes
    "reborrow' k deriv orig stack stack'"
    "wf_reborrow stack"
    "deriv \<notin> collect_tags stack"
  shows "wf_reborrow stack'"
using assms proof (induction)
  case (DerivPop k deriv orig tail stack entry)
  then show ?case using reborrow'_nonempty_src wf_reborrow_pop' by auto
qed (auto simp add: ReborrowSRWSRW ReborrowSROSRO)

lemma wf_reborrow_reborrow'_the:
  assumes
    "writable orig stack"
    "wf_reborrow stack"
    "deriv \<notin> collect_tags stack"
  shows "wf_reborrow (THE stack'. reborrow' k deriv orig stack stack')"
  using assms wf_reborrow_reborrow'
  by (metis reborrow_by_comp the_reborrow'_writable the_reborrow_by_comp the_reborrow_by_comp')

lemma stack_finite_reborrow':
  assumes
    "reborrow' k deriv orig stack stack'"
    "stack_finite stack"
  shows "stack_finite stack'"
using assms proof (induction, auto)
qed

lemma reborrow'_subset:
  assumes "reborrow' k deriv orig stack stack'"
  shows "collect_tags stack' \<subseteq> {deriv} \<union> collect_tags stack"
using assms proof (induction, auto)
qed

lemma writable_reborrow:
  assumes
    "reborrow' k deriv orig stack stack'"
    "wf_reborrow stack"
    "writable orig stack"
    "deriv \<notin> collect_tags stack"
  shows "writable orig stack'"
using assms proof (induction)
  case (DerivPop k deriv orig tail stack entry)
  show ?case
  proof (rule DerivPop.IH)
    show "wf_reborrow tail" using DerivPop wf_reborrow_pop' reborrow'_nonempty_src by simp
  next
    show "writable orig tail" using DerivPop writable_tl by fastforce
  next
    show "deriv \<notin> collect_tags tail" using DerivPop.prems by simp
  qed
qed auto

lemma writable_reborrow_the:
  assumes
    "wf_reborrow stack"
    "writable orig stack"
    "deriv \<notin> collect_tags stack"
  shows "writable orig (THE stack'. reborrow' k deriv orig stack stack')"
  using writable_reborrow
  by (metis assms ex_reborrow'_writable reborrow_by_comp the_reborrow_by_comp')

lemma writable_reborrow_derived:
  assumes
    "reborrow' k deriv orig stack stack'"
    "writable orig stack"
    "wf_reborrow stack"
    "k = Unique \<or> k = SharedReadWrite"
  shows "writable deriv stack'"
using assms proof (induction)
  case (DerivPop k deriv orig tail stack entry)
  show ?case
  proof (rule DerivPop.IH)
    show "wf_reborrow tail" using DerivPop wf_reborrow_pop' reborrow'_nonempty_src by simp
  next
    show "writable orig tail" using DerivPop writable_tl by fastforce
  next
    show "k = Unique \<or> k = SharedReadWrite" using DerivPop.prems by simp
  qed
qed auto

lemma writable_reborrow_derived_the:
  assumes
    "writable orig stack"
    "wf_reborrow stack"
    "k = Unique \<or> k = SharedReadWrite"
  shows "writable deriv (THE stack'. reborrow' k deriv orig stack stack')"
  using writable_reborrow_derived
  by (metis assms ex_reborrow'_writable reborrow_by_comp the_reborrow_by_comp')

lemma reborrow_comp_by_ind:
  assumes
    "wf_reborrow stack"
    "reborrow_comp k deriv orig stack = stack'"
    "stack' \<noteq> []"
  shows
    "reborrow' k deriv orig stack stack'"
using assms proof (induction rule: wf_reborrow_induct')
  case (Root t)
  consider "orig \<noteq> t" | "orig = t" by auto
  then show ?case
  proof (cases)
    case 1
    then show ?thesis using Root by simp
  next
    case 2
    then show ?thesis using Root reborrow_by_comp the_reborrow'_writable by fastforce
  qed
next
  case (UniqueUnique t t' tail)
  consider "t' \<noteq> orig" | "t' = orig" by auto
  then show ?case
  proof (cases)
    case 1
    then have "reborrow_comp k deriv orig ((Unique, {t}) # tail) = stack'"
      using UniqueUnique.prems(1) by auto
    then show ?thesis using UniqueUnique \<open>t' \<noteq> orig\<close> reborrow'.intros(8) by auto
  next
    case 2
    then show ?thesis
    proof (cases k)
      case Unique
      then show ?thesis using 2 UniqueUnique DerivUniqueUnique by auto
    next
      case SharedReadWrite
      then show ?thesis using 2 UniqueUnique DerivUniqueSRW by auto
    next
      case SharedReadOnly
      then show ?thesis using 2 UniqueUnique DerivUniqueSRO by auto
    qed
  qed
next
  case (UniqueSRW t ts' tail)
  consider "orig \<notin> ts'" | "orig \<in> ts'" by auto
  then show ?case
  proof (cases)
    case 1
    then have "reborrow_comp k deriv orig ((Unique, {t}) # tail) = stack'"
      using UniqueSRW.prems(1) by auto
    then show ?thesis using UniqueSRW \<open>orig \<notin> ts'\<close> reborrow'.intros(8) by auto
  next
    case 2
    then show ?thesis
    proof (cases k)
      case Unique
      then show ?thesis using 2 UniqueSRW DerivSRWUnique by auto
    next
      case SharedReadWrite
      then show ?thesis using 2 UniqueSRW DerivSRWSRW by auto
    next
      case SharedReadOnly
      then show ?thesis using 2 UniqueSRW DerivSRWSRO by auto
    qed
  qed
next
  case (UniqueSRO t ts' tail)
  consider "orig \<notin> ts'" | "orig \<in> ts'" by auto
  then show ?case
  proof (cases)
    case 1
    then have "reborrow_comp k deriv orig ((Unique, {t}) # tail) = stack'"
      using UniqueSRO.prems(1) by auto
    then show ?thesis using UniqueSRO \<open>orig \<notin> ts'\<close> reborrow'.intros(8) by auto
  next
    case 2
    then show ?thesis
    proof (cases k)
      case Unique
      then show ?thesis using 2 UniqueSRO by auto
    next
      case SharedReadWrite
      then show ?thesis using 2 UniqueSRO by auto
    next
      case SharedReadOnly
      then show ?thesis using 2 UniqueSRO DerivSROSRO by auto
    qed
  qed
next
  case (SRWUnique ts t' tail)
  consider "t' \<noteq> orig" | "t' = orig" by auto
  then show ?case
  proof (cases)
    case 1
    then have "reborrow_comp k deriv orig ((SharedReadWrite, ts) # tail) = stack'"
      using SRWUnique.prems(1) by auto
    then show ?thesis using SRWUnique \<open>t' \<noteq> orig\<close> reborrow'.intros(8) by auto
  next
    case 2
    then show ?thesis
    proof (cases k)
      case Unique
      then show ?thesis using 2 SRWUnique DerivUniqueUnique by auto
    next
      case SharedReadWrite
      then show ?thesis using 2 SRWUnique DerivUniqueSRW by auto
    next
      case SharedReadOnly
      then show ?thesis using 2 SRWUnique DerivUniqueSRO by auto
    qed
  qed
next
  case (SRWSRO ts ts' tail)
  consider "orig \<notin> ts'" | "orig \<in> ts'" by auto
  then show ?case
  proof (cases)
    case 1
    then have "reborrow_comp k deriv orig ((SharedReadWrite, ts) # tail) = stack'"
      using SRWSRO.prems(1) by auto
    then show ?thesis using SRWSRO \<open>orig \<notin> ts'\<close> reborrow'.intros(8) by auto
  next
    case 2
    then show ?thesis
    proof (cases k)
      case Unique
      then show ?thesis using 2 SRWSRO by auto
    next
      case SharedReadWrite
      then show ?thesis using 2 SRWSRO by auto
    next
      case SharedReadOnly
      then show ?thesis using 2 SRWSRO DerivSROSRO by auto
    qed
  qed
qed

lemma reborrow_equivalence:
  assumes
    "wf_reborrow stack"
    "writable orig stack \<or> (readable orig stack \<and> k = SharedReadOnly)"
  shows "reborrow_comp k deriv orig stack = stack' \<longleftrightarrow> reborrow' k deriv orig stack stack'"
  using assms reborrow_by_comp reborrow_comp_by_ind nonempty_reborrow_comp_if_valid_reborrow
  by fast

lemma wf_reborrow_pop''[
  consumes 1,
  case_names Root Reborrow
]:
  assumes
    "wf_reborrow stack"
  obtains
    t where
    "stack = [(Unique, {t})]"
  | entry and tail where
    "stack = entry # tail" and
    "wf_reborrow tail"
  by (metis assms last.simps neq_Nil_conv wf_reborrow_pop'
      wf_reborrow_root wf_reborrow_structure_elims(1))

lemma writable_reborrow_comp_derived':
  assumes
    "writable t stack"
    "reborrow_comp k t' t stack = stack'"
    "wf_reborrow stack"
    "k = Unique \<or> k = SharedReadWrite"
  shows "writable t' stack'"
proof -
  have "reborrow' k t' t stack stack'"
    using assms reborrow_equivalence by simp
  then show ?thesis
  using assms proof (induction)
    case (DerivPop k deriv orig tail stack entry)
    moreover have "writable orig tail"
      using writable_tl DerivPop by fastforce
    moreover have "wf_reborrow tail"
      using reborrow'_nonempty_src wf_reborrow_pop' calculation by blast
    moreover have "reborrow_comp k deriv orig tail = stack"
      using reborrow_equivalence calculation by simp
    ultimately show ?case by simp
  qed auto
qed

end


theory flash81Rev imports flashPub
begin
section{*Main defintions*}
lemma NI_FAckVsInv81:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv81 ) (NI_FAck ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma NI_InvVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Inv  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_InvAck_1VsInv81:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv81 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_InvAck_1_HomeVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_InvAck_1_Home  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_InvAck_2VsInv81:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_InvAck_2 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have allCases:"formEval   (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) )  s  \<or>formEval  ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  )  s  "
	                      by auto

    moreover
                       {assume b1:"formEval  (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) )  s"
have "?P2 s"

  apply(cut_tac  a1  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)

  done

  then  have "?P1 s\<or> ?P2 s \<or> ?P3 s"

        by blast
    }

    moreover
                       {assume b1:"formEval ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  )  s"

      have "?P1 s"

        apply(cut_tac  a1  b1 , auto)

        done

        then  have "?P1 s\<or> ?P2 s \<or> ?P3 s"

       by blast
    }
   ultimately show "?P1 s\<or> ?P2 s\<or> ?P3 s"

	                         by metis

 qed
lemma NI_Local_GetX_GetXVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_GetX  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_Nak1VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_Nak2VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_Nak3VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX1VsInv81:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_GetX_PutX2VsInv81:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_GetX_PutX3VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX4VsInv81:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_GetX_PutX5VsInv81:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_GetX_PutX6VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX7VsInv81:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_GetX_PutX8VsInv81:
  (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1  a2  a3 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_GetX_PutX8_homeVsInv81:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_GetX_PutX9VsInv81:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_GetX_PutX10VsInv81:
  (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1  a2  a3 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_GetX_PutX10_homeVsInv81:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_GetX_PutX11VsInv81:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_Get_GetVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_Get_Get  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Nak1VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_Get_Nak1  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Nak2VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_Get_Nak2  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Nak3VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_Get_Nak3  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Put1VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Put2VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_Get_Put2  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Put3VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Local_Get_Put3  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_PutVsInv81:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv81 ) (NI_Local_Put ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(    simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') )  ( Const WB_Wb ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) )  ( Const UNI_Put ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma NI_Local_PutXAcksDoneVsInv81:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv81 ) (NI_Local_PutXAcksDone ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(    simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') )  ( Const WB_Wb ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) )  ( Const UNI_PutX ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma NI_NakVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Nak  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Nak_ClearVsInv81:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv81 ) (NI_Nak_Clear ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma NI_Nak_HomeVsInv81:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv81 ) (NI_Nak_Home ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma NI_Remote_GetX_NakVsInv81:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv81 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_GetX_Nak_HomeVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_GetX_PutXVsInv81:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv81 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_GetX_PutX_HomeVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_Get_Nak1VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_Get_Nak2VsInv81:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv81 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_Get_Put1VsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Remote_Get_Put1  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_Get_Put2VsInv81:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv81 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_PutVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Remote_Put  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_PutXVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Remote_PutX  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_ReplaceVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_Replace  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_ReplaceHomeVsInv81:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv81 ) (NI_ReplaceHome ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma NI_ReplaceHomeShrVldVsInv81:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv81 ) (NI_ReplaceHomeShrVld ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma NI_ReplaceShrVldVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (NI_ReplaceShrVld  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_ShWbVsInv81:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv81 ) (NI_ShWb N ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma NI_WbVsInv81:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv81 ) (NI_Wb ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply( auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma PI_Local_GetX_GetX1VsInv81:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv81 ) (PI_Local_GetX_GetX1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma PI_Local_GetX_GetX2VsInv81:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv81 ) (PI_Local_GetX_GetX2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma PI_Local_GetX_PutX1VsInv81:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv81 ) (PI_Local_GetX_PutX1 N ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(    simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') )  ( Const WB_Wb ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma PI_Local_GetX_PutX2VsInv81:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv81 ) (PI_Local_GetX_PutX2 N ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(    simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') )  ( Const WB_Wb ))    ( eqn ( IVar ( Para ''CacheState'' Home) )  ( Const CACHE_S ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma PI_Local_GetX_PutX3VsInv81:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv81 ) (PI_Local_GetX_PutX3 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(    simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') )  ( Const WB_Wb ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma PI_Local_GetX_PutX4VsInv81:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv81 ) (PI_Local_GetX_PutX4 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(    simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') )  ( Const WB_Wb ))    ( eqn ( IVar ( Para ''CacheState'' Home) )  ( Const CACHE_S ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma PI_Local_Get_GetVsInv81:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv81 ) (PI_Local_Get_Get ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma PI_Local_Get_PutVsInv81:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv81 ) (PI_Local_Get_Put ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(    simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Global ''WbMsg_Cmd'') )  ( Const WB_Wb ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma PI_Local_PutXVsInv81:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv81 ) (PI_Local_PutX ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have allCases:"formEval  ( eqn ( IVar ( Global ''Dir_Pending'') )  ( Const true ))  s  \<or>formEval   (neg ( eqn ( IVar ( Global ''Dir_Pending'') )  ( Const true )) )  s  "
	                      by auto

    moreover
                       {assume b1:"formEval ( eqn ( IVar ( Global ''Dir_Pending'') )  ( Const true ))  s"
have "?P2 s"

  apply(cut_tac  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)

  done

  then  have "?P1 s\<or> ?P2 s \<or> ?P3 s"

        by blast
    }

    moreover
                       {assume b1:"formEval  (neg ( eqn ( IVar ( Global ''Dir_Pending'') )  ( Const true )) )  s"

      have "?P1 s"

        apply(cut_tac  b1 , auto)

        done

        then  have "?P1 s\<or> ?P2 s \<or> ?P3 s"

       by blast
    }
   ultimately show "?P1 s\<or> ?P2 s\<or> ?P3 s"

	                         by metis

 qed
lemma PI_Local_ReplaceVsInv81:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv81 ) (PI_Local_Replace ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply( auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma PI_Remote_GetVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (PI_Remote_Get  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma PI_Remote_GetXVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (PI_Remote_GetX  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma PI_Remote_PutXVsInv81:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (PI_Remote_PutX  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(   cut_tac  a1 , simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma PI_Remote_ReplaceVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (PI_Remote_Replace  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma StoreVsInv81:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv81 ) (Store  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma StoreHomeVsInv81:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv81 ) (StoreHome ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  end


theory flash111Rev imports flashPub
begin
section{*Main defintions*}
lemma NI_FAckVsInv111:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv111 ) (NI_FAck ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma NI_InvVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Inv  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_InvAck_1VsInv111:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv111 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_InvAck_1_HomeVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_InvAck_1_Home  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_InvAck_2VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_InvAck_2 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_GetXVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_GetX  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_Nak1VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_Nak2VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_Nak3VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX1VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX2VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX3VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX4VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX5VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX6VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX7VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX8VsInv111:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX8_homeVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX9VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX10VsInv111:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX10_homeVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_GetX_PutX11VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_GetVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_Get_Get  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Nak1VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_Get_Nak1  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Nak2VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_Get_Nak2  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Nak3VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_Get_Nak3  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Put1VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Put2VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_Get_Put2  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_Get_Put3VsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Local_Get_Put3  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Local_PutVsInv111:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv111 ) (NI_Local_Put ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply( auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Local_PutXAcksDoneVsInv111:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv111 ) (NI_Local_PutXAcksDone ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply( auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_NakVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Nak  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Nak_ClearVsInv111:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv111 ) (NI_Nak_Clear ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma NI_Nak_HomeVsInv111:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv111 ) (NI_Nak_Home ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply( auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Remote_GetX_NakVsInv111:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv111 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_GetX_Nak_HomeVsInv111:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Remote_GetX_PutXVsInv111:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv111 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_GetX_PutX_HomeVsInv111:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Remote_Get_Nak1VsInv111:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Remote_Get_Nak2VsInv111:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv111 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_Get_Put1VsInv111:
  (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Remote_Get_Put1  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply(cut_tac  a1 , auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma NI_Remote_Get_Put2VsInv111:
    (*Rule2VsPInv0*)
  assumes   a1:"iRule1 \<le> N" and  a2:"iRule2 \<le> N" and  a3:"iRule1~=iRule2  "

  shows  "invHoldForRule' s (inv111 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1 a2 a3,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_PutVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Remote_Put  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_Remote_PutXVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Remote_PutX  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_ReplaceVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_Replace  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_ReplaceHomeVsInv111:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv111 ) (NI_ReplaceHome ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma NI_ReplaceHomeShrVldVsInv111:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv111 ) (NI_ReplaceHomeShrVld ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma NI_ReplaceShrVldVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (NI_ReplaceShrVld  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma NI_ShWbVsInv111:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv111 ) (NI_ShWb N ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma NI_WbVsInv111:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv111 ) (NI_Wb ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma PI_Local_GetX_GetX1VsInv111:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv111 ) (PI_Local_GetX_GetX1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply( auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma PI_Local_GetX_GetX2VsInv111:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv111 ) (PI_Local_GetX_GetX2 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply( auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma PI_Local_GetX_PutX1VsInv111:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv111 ) (PI_Local_GetX_PutX1 N ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(    simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Para ''procCmd'' Home) )  ( Const NODE_None ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) )  ( Const UNI_GetX ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma PI_Local_GetX_PutX2VsInv111:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv111 ) (PI_Local_GetX_PutX2 N ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma PI_Local_GetX_PutX3VsInv111:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv111 ) (PI_Local_GetX_PutX3 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(    simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Para ''procCmd'' Home) )  ( Const NODE_None ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) )  ( Const UNI_GetX ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma PI_Local_GetX_PutX4VsInv111:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv111 ) (PI_Local_GetX_PutX4 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(    simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Para ''procCmd'' Home) )  ( Const NODE_None ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) )  ( Const UNI_GetX ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma PI_Local_Get_GetVsInv111:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv111 ) (PI_Local_Get_Get ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P1 s"

        apply( auto)

        done

        then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

       by blast

 qed
lemma PI_Local_Get_PutVsInv111:
  (*Rule0VsPInv0*)
  shows  "invHoldForRule' s (inv111 ) (PI_Local_Get_Put ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

      have "?P3 s"

        apply(    simp)

        apply(rule_tac x=" (neg ( andForm ( eqn ( IVar ( Para ''procCmd'' Home) )  ( Const NODE_None ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) )  ( Const UNI_GetX ))  ) ) " in exI,auto)

        done

       then  show "?P1 s\<or> ?P2 s\<or> ?P3 s"

        by blast

 qed
lemma PI_Local_PutXVsInv111:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv111 ) (PI_Local_PutX ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma PI_Local_ReplaceVsInv111:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv111 ) (PI_Local_Replace ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  lemma PI_Remote_GetVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (PI_Remote_Get  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma PI_Remote_GetXVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (PI_Remote_GetX  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma PI_Remote_PutXVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (PI_Remote_PutX  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma PI_Remote_ReplaceVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (PI_Remote_Replace  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma StoreVsInv111:
    (*Rule1VsPInv0*)
  assumes   a1:"iRule1 \<le> N"

  shows  "invHoldForRule' s (inv111 ) (Store  iRule1 ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

  proof -

     have "?P2 s"

     by (cut_tac a1,auto  )
   then show "?P1 s\<or>?P2 s\<or>?P3 s"
      by auto
 qed
  lemma StoreHomeVsInv111:
    (*Rule0VsPInv0*)

  shows  "invHoldForRule' s (inv111 ) (StoreHome ) (invariants   N)" (is " ?P1 s\<or>?P2 s\<or>?P3 s")

      by( auto)

  end


(*  Title:      HOL/Auth/n_german_lemma_inv__18_on_rules.thy
    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
*)

header{*The n_german Protocol Case Study*}

theory n_german_lemma_inv__18_on_rules imports n_german_lemma_on_inv__18
begin
section{*All lemmas on causal relation between inv__18*}
lemma lemma_inv__18_on_rules:
  assumes b1: "r \<in> rules N" and b2: "(\<exists> p__Inv2. p__Inv2\<le>N\<and>f=inv__18  p__Inv2)"
  shows "invHoldForRule s f r (invariants N)"
  proof -
  have c1: "(\<exists> i d. i\<le>N\<and>d\<le>N\<and>r=n_Store  i d)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendReqS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendReqE__part__0  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendReqE__part__1  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvReqS N i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvReqE N i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInv__part__0  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInv__part__1  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInvAck  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvInvAck  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendGntS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendGntE N i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvGntS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvGntE  i)"
  apply (cut_tac b1, auto) done
    moreover {
      assume d1: "(\<exists> i d. i\<le>N\<and>d\<le>N\<and>r=n_Store  i d)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_StoreVsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendReqS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqSVsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendReqE__part__0  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendReqE__part__1  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvReqS N i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvReqSVsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvReqE N i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvReqEVsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInv__part__0  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInv__part__1  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInvAck  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInvAckVsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvInvAck  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendGntS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendGntSVsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendGntE N i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendGntEVsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvGntS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvGntSVsinv__18) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvGntE  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvGntEVsinv__18) done
    }

  ultimately show "invHoldForRule s f r (invariants N)"
  by satx
qed

end